CVE-2018-5212: Simple Download Monitor Project Simple Download Monitor

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.

Affected products

• Simple Download Monitor Project Simple Download Monitor: version 3.5.4 only

Published 2018-01-04. Last modified 2026-06-17.