LiveActive security incident?Get immediate response
CVE Record

CVE-2014-125090: Media Downloader Plugin getfile.php dl_file_resumable cross site scripting

A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.

MediumCVSS 4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2014-125090 is a cross-site scripting flaw in the WordPress Media Downloader Plugin. An authenticated remote user could manipulate the file parameter handled by getfile.php, potentially causing script execution in a victim’s browser. The known affected version is 0.1.992, and the cited fix is version 0.1.993.

Executive priority

Treat this as a moderate web application risk. It is not KEV-listed and requires authentication, but exposed WordPress plugins can create reputational and user-session risk. Patch during the next normal vulnerability remediation cycle unless the plugin is broadly accessible to untrusted users.

Technical view

Media Downloader Plugin 0.1.992 contains CWE-79 in getfile.php, affecting dl_file_resumable through the file argument. The CVSS v2 vector is AV:N/AC:L/Au:S/C:N/I:P/A:N, indicating network reachability, low complexity, authentication required, partial integrity impact, and no confidentiality or availability impact.

Likely exposure

Exposure is limited to WordPress sites running Media Downloader Plugin 0.1.992. The source bundle does not provide installation prevalence, default reachability, or evidence that unauthenticated users can trigger the issue.

Exploitation context

The vulnerability can be initiated remotely, but the CVSS vector indicates authentication is required. The source bundle marks KEV as false and provides no cited evidence of active exploitation in the wild.

Researcher notes

The public data is concise: affected component, parameter, CWE, CVSS, and patch are identified. The bundle does not include proof-of-concept details, exploit telemetry, or broader affected version ranges, so avoid expanding scope beyond Media Downloader Plugin 0.1.992.

Mitigation direction

  • Upgrade Media Downloader Plugin to version 0.1.993 or later.
  • Confirm the patch commit is present in deployed plugin code.
  • Restrict plugin access where upgrade timing is uncertain.
  • Check vendor or maintainer guidance for any additional hardening.

Validation and detection

  • Inventory WordPress sites for Media Downloader Plugin installations.
  • Verify installed plugin versions are not 0.1.992.
  • Review getfile.php for the cited patch changes.
  • Confirm authenticated roles with access to downloader functionality.
  • Document any remaining unpatched instances and owners.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2014-125090 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4CVSS 2.0MediumAV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE score

Vulnerability scoring details

Base CVSS 2.0 score

4Medium
CVSS 2.0 vector shape for CVE-2014-125090Access VectorAccess ComplexityAuthenticationConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Access Vector
NetworkAdjacentLocal
Access Complexity
LowMediumHigh
Authentication
NoneSingleMultiple
Confidentiality Impact
CompletePartialNone
Integrity Impact
CompletePartialNone
Availability Impact
CompletePartialNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aMedia Downloader Plugin0.1.992Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.