WordPress Plugin Vulnerabilities

Download manager < 3.2.43 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape the frameid parameter before outputting it back in a JS context, leading to a Reflected Cross-Site Scripting

Affects Plugins

Plugin icon
download-manager
Fixed in 3.2.43

References

CVE
CVE-2022-1985
URL
https://www.wordfence.com/blog/2022/06/security-vulnerability-download-manager-plugin/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad (Yeraisci)
Verified
Yes
WPVDB ID
19352d3c-6346-49d8-a673-e9f4882c5907

Timeline

Publicly Published
2022-06-02 (about 3 years ago)
Added
2022-06-02 (about 3 years ago)
Last Updated
2023-03-10 (about 3 years ago)

Other

Published
Title
Published
2024-10-28
Title
PostX < 4.1.16 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2025-01-10
Title
Tabulate <= 2.10.3 - Reflected XSS
Published
2014-08-01
Title
AVChat Video Chat 1.4.1 - index_popup.php Multiple Parameters Reflected XSS
Published
2023-04-24
Title
Arconix Shortcodes < 2.1.8 - Contributor+ Stored XSS
Published
2023-03-17
Title
Return and Warranty Management System for WooCommerce <= 1.2.3 - Reflected Cross-Site Scripting