Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through <= 1.4.2.
Published: 2025-01-23
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an Improper Neutralization of Input During Web Page Generation (CWE‑79) in the WordPress plugin Download, Downloads (ydn‑download). It allows attackers to inject malicious script that is reflected back to the victim’s browser when the plugin processes user‑supplied data. The impacted code path outputs unsanitized input, enabling arbitrary JavaScript execution in the context of the site.

Affected Systems

Any WordPress installation that has the Download, Downloads plugin from edmon.parker with a version of 1.4.2 or earlier is affected. The issue is present in all releases up to and including 1.4.2.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity of this reflected XSS flaw. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted URL or form submission that includes malicious script targeting the plugin’s input fields, which is reflected back to the user. Given the moderate exploitation probability, sites should prioritize patching.

Generated by OpenCVE AI on May 2, 2026 at 09:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Download, Downloads plugin to a version newer than 1.4.2, which removes the XSS flaw.
  • If an upgrade is not immediately possible, temporarily deactivate the plugin to eliminate the vulnerable code path.
  • Apply a web‑application firewall rule or a content‑security‑policy to block malicious script injection into the plugin’s request parameters.

Generated by OpenCVE AI on May 2, 2026 at 09:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3239 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon Download, Downloads allows Reflected XSS. This issue affects Download, Downloads : from n/a through 1.4.2.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Fri, 03 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon Download, Downloads allows Reflected XSS. This issue affects Download, Downloads : from n/a through 1.4.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through <= 1.4.2.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Thu, 23 Jan 2025 15:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon Download, Downloads allows Reflected XSS. This issue affects Download, Downloads : from n/a through 1.4.2.
Title WordPress Download, Downloads plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:12.632Z

Reserved: 2025-01-16T11:25:56.885Z

Link: CVE-2025-23541

cve-icon Vulnrichment

Updated: 2025-02-12T20:35:20.872Z

cve-icon NVD

Status : Deferred

Published: 2025-01-23T16:15:37.737

Modified: 2026-06-17T08:55:13.163

Link: CVE-2025-23541

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T09:45:36Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')