Wpfactory Download Plugins And Themes From Dashboard vulnerabilities

2 CVEs affecting Wpfactory Download Plugins And Themes From Dashboard, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-35162, published 2024-05-22.

More from Wpfactory.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-17239, published 2019-10-07. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
• CVE-2024-35162, published 2024-05-22. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switch_themes"…