Threats tagged 'ghsa-fc9h-r65m-ghj7'

The Download Manager plugin for WordPress, developed by codename065, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the 'REFERRER' parameter. This vulnerability exists in all versions up to and including 3.3.57 due to insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this flaw to inject arbitrary scripts that execute in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity level.