CVE-2026-12054

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.58

Description The Download Manager plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute within the browser of a victim via the REFERRER parameter.

Recommendations Update the plugin to version 3.3.58 or later. Avoid using the REFERRER parameter until the update is applied.