The Download Manager WordPress plugin by codename065 suffers from a reflected XSS vulnerability (CWE-79) via the 'redirect_to' parameter in the login form shortcode. This parameter is not properly sanitized or escaped, enabling attackers to inject malicious scripts that execute in the context of users who interact with crafted URLs. The vulnerability affects all versions up to 3.3.46 and requires user interaction (clicking a link) to trigger. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, with impact on confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable shortcode or applying custom input sanitization and output escaping on the 'redirect_to' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.