CVE-2026-12054: Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
W3 Eden Download Manager for WordPress is affected in all versions through 3.3.57, inclusive.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate and can supply a malicious REFERRER parameter. Exploitation requires a victim to interact with attacker-controlled content so the injected script executes in the victim's browser.
What is the likely impact on a successful exploit?
The vulnerability can allow arbitrary script execution in the victim's browser, with potential confidentiality and integrity impact in that browser context. Availability impact is not indicated.