Reflected Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress
CVE-2025-10146
6.1MEDIUM
What is CVE-2025-10146?
The Download Manager plugin for WordPress features a vulnerability that can be exploited through the 'user_ids' parameter, which fails to properly sanitize user input and escape output. This flaw allows unauthenticated attackers to inject malicious scripts into affected pages. If a user interacts with these compromised links, their session can be hijacked, or malicious content can be executed, highlighting the importance of securing plugins with robust input validation practices.
Affected Version(s)
Download Manager * <= 3.3.23
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Dale Mavers