Stored Cross-Site Scripting Vulnerability in Lana Downloads Manager Plugin for WordPress

CVE-2025-7387

What is CVE-2025-7387?

The Lana Downloads Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting flaw due to inadequate input sanitization and output escaping for user-supplied attributes. Attackers with admin-level access can exploit this vulnerability to inject arbitrary web scripts into pages. When users access these compromised pages, the injected scripts are executed, potentially leading to harmful consequences such as data theft or unauthorized actions.

References