Download Manager < 3.2.53 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute of the modal login page (only available when users are not logged in), which could lead to Reflected Cross-Site Scripting in old web browsers.

On the modal login page from the plugin and using an old web browser (such as IE), append ?a"><script>alert(/XSS/)</script>

e.g: https://example.com/login/?a"><script>alert(/XSS/)</script>