CVE-2025-8294
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>Using this plugin, you will get file download statistics.</p>
<p>Use the shortcode <code>[download_counter_url name='file_name']</code> – to get the link.</p>
<p>Use the shortcode <code>[download_counter_count name='file_name']</code> – to get the number of downloads.</p>
<p>Use the shortcode <code>[download_counter_size name='file_name']</code> – to get the size.</p>
<p>Use the shortcode <code>[download_counter_date name='file_name' format='date_format']</code> – to get the date of the last download.</p>
<p>Visit the plugin settings to specify the path to the directory with files.</p>
<p>Then use the shortcode to display the download link or the shortcode to display the number of downloads in any post or page.</p>
<p>The plugin will then count each successful download and display the statistics in the plugin settings.</p>
<p><strong>Features</strong></p>
<ul>
<li>Simple counter of successful downloads</li>
<li>Recording statistics to a local database</li>
<li>Path to the directory with files – anywhere on the server</li>
<li>Output of download statistics in the settings</li>
<li>Lightweight – the entire plugin size is < 100 KB</li>
<li>Super fast and designed for optimal performance</li>
<li>Clean code</li>
</ul>
WordPress Plugin Directory