CVE-2026-1666

The Download Manager plugin for WordPress versions up to 3.3.46 contains a Reflected Cross-Site Scripting (XSS) vulnerability in the login form shortcode [wpdm_login_form]. The 'redirect_to' GET parameter is not properly sanitized or escaped, allowing injected scripts to be reflected in the page. The official documentation shows that the 'redirect' parameter accepts a URL to redirect users after login, but the plugin fails to validate or sanitize this input [1].

Exploitation requires no authentication; any unauthenticated attacker can craft a malicious link with a 'redirect_to' parameter containing JavaScript. The attack depends on social engineering — the victim must click the crafted link. This type of attack is often delivered via phishing emails or forum posts. The parameter is processed server-side and reflected, executing the script in the user's browser context [1].

Successful exploitation leads to arbitrary script execution in the victim's browser session, enabling cookie theft, session hijacking, redirection to malicious sites, or defacement of the page. Because the vulnerability is reflected, impact is limited to users who interact with the malicious link.

Users should update to version 3.3.47 or later once available. As of the publication date, the vendor was notified and a fix should be forthcoming. Until patched, avoid clicking untrusted links that involve the login form and consider using a Web Application Firewall (WAF) to block malicious query strings.