https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:46:12.710831+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-1666 CVE-2026-1666 — Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter 2026-10-07T22:46:12.726696+00:00

Affected: codename065 Download Manager

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.