Simple Download Counter Vulnerabilities

Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute vulnerability

CVSS:

6.5

Affected:

up to 2.3

Fixed in:

2.3.1

Disclosed:

Mar 27, 2026

The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sdc_menu' shortcode in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes, specifically the 'text' and 'cat' attributes. Th...

CVSS:

6.4

Affected:

up to 2.3

Fixed in:

2.3.1

Disclosed:

Mar 25, 2026

CVE-2026-4278 on NVD →

The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above,...

CVSS:

4.9

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Dec 9, 2025

CVE-2025-13677 on NVD →

The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 2.2

Fixed in:

2.2.1

Disclosed:

Apr 22, 2025

CVE-2025-46240 on NVD →

The Simple Download Counter plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.0 via the 'simple_download_counter_download_handler'. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including any local file o...

CVSS:

6.5

Affected:

up to 2.0

Fixed in:

2.1

Disclosed:

Feb 28, 2025

CVE-2025-1730 on NVD →

The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'before' and 'after'. This makes it possible for authenticated attac...

CVSS:

6.4

Affected:

1.6 – 1.6

Fixed in:

1.6.1

Disclosed:

Sep 8, 2023

CVE-2023-4838 on NVD →