Medium severity6.1NVD Advisory· Published Oct 10, 2026

CVE-2026-12054

Description

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected products

WordPress/Download Managerllm-fuzzy
Range: <=3.3.57
Package: https://wordpress.org/plugins/download-manager

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3573804/download-managernvd
www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000