CVE-2018-5212

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.

• CWE-79

• https://github.com/Arsenal21/simple-download-monitor/commit/8ab8b9166bc87feba26a1573cf595af48eff7805Patch, Third Party Advisory
• https://github.com/Arsenal21/simple-download-monitor/issues/27Exploit, Third Party Advisory
• https://github.com/d4wner/Vulnerabilities-Report/blob/master/simple-download-monitor.mdExploit, Third Party Advisory
• https://wordpress.org/support/topic/stored-xss-bug-at-the-latest-version-of-simple-download-monitor/Broken Link
• https://github.com/Arsenal21/simple-download-monitor/commit/8ab8b9166bc87feba26a1573cf595af48eff7805Patch, Third Party Advisory
• https://github.com/Arsenal21/simple-download-monitor/issues/27Exploit, Third Party Advisory
• https://github.com/d4wner/Vulnerabilities-Report/blob/master/simple-download-monitor.mdExploit, Third Party Advisory
• https://wordpress.org/support/topic/stored-xss-bug-at-the-latest-version-of-simple-download-monitor/Broken Link

Published

Jan 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5205When using incomplete escape codes, Irssi before 1.0.6 may a…
• CVE-2018-5206When the channel topic is set without specifying a sender, I…
• CVE-2018-5207When using an incomplete variable argument, Irssi before 1.0…
• CVE-2018-5208In Irssi before 1.0.6, a calculation error in the completion…
• CVE-2018-5210On Samsung mobile devices with N(7.x) software and Exynos ch…
• CVE-2018-5211PHP Melody version 2.7.1 suffer from SQL Injection Time-base…
• CVE-2018-5213The Simple Download Monitor plugin before 3.5.4 for WordPres…
• CVE-2018-5214The "Add Link to Facebook" plugin through 2.3 for WordPress …
• CVE-2018-5215Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the tit…
• CVE-2018-5216Radiant CMS 1.1.4 has XSS via crafted Markdown input in the …
• CVE-2018-5217In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) al…
• CVE-2018-5218In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) al…