Threats tagged 'ghsa-fwf8-w66j-76rr'

The Download Manager plugin for WordPress versions up to and including 7.5.9 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'wpdm_reg[first_name]', 'wpdm_reg[last_name]', and 'wpdm_reg[user_login]' parameters. Exploitation requires the WordPress site to have user registration enabled, the plugin's registration form shortcode published on a public page, and at least one package authored by user ID 1 displayed with the Spotlight link template. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages.