Reflected Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress

CVE-2025-10146

What is CVE-2025-10146?

The Download Manager plugin for WordPress features a vulnerability that can be exploited through the 'user_ids' parameter, which fails to properly sanitize user input and escape output. This flaw allows unauthenticated attackers to inject malicious scripts into affected pages. If a user interacts with these compromised links, their session can be hijacked, or malicious content can be executed, highlighting the importance of securing plugins with robust input validation practices.

References