Threats tagged 'ghsa-c563-3pgf-9rc7'

The Simple Downloads List plugin for WordPress contains a vulnerability in all versions up to and including 1.4.3 that allows authenticated users with Subscriber-level access or higher to modify plugin data without proper authorization. This is due to missing capability checks on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint and others, enabling attackers to alter plugin settings and inject malicious scripts.