CVE-2025-26895

WordPress m1.DownloadList plugin <= 0.19 - Cross Site Scripting (XSS) vulnerability

Published Mar 15, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-Based XSS.This issue affects m1.DownloadList: from n/a through <= 0.19.

Analysis

Technical impact

The vulnerability is a DOM‑based Cross‑Site Scripting flaw in the WordPress plugin m1.DownloadList from maennchen1.de. Improper handling of user‑supplied input allows an attacker to inject arbitrary JavaScript that executes within the victim’s browser session, potentially enabling cookie theft, defacement, or execution of malicious payloads. This weakness is classified as CWE‑79.

Affected Systems

WordPress installations that use the m1.DownloadList plugin from vendor maennchen1.de and run any released version through 0.19. Users operating version 0.19 or older are vulnerable; newer releases are not listed as affected.

Risk and Exploitability

The CVSS score of 6.5 denotes moderate severity, while the EPSS score of less than 1 % indicates that exploitation is considered unlikely but still possible. The vulnerability is not currently listed in the CISA KEV catalog. The most probable attack vector involves a user visiting a page that contains crafted input—for example, clicking a malicious link or submitting a form that triggers the DOM‑based XSS.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

maennchen1.de

m1.DownloadList

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.19

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the m1.DownloadList plugin to a version that fixes the DOM‑based XSS, such as 0.20 or later.
If an upgrade is not immediately feasible, disable the plugin or restrict its use to trusted administrators, and ensure that any dynamic content it renders is properly sanitized before output.
Implement a strict Content Security Policy that disallows inline scripts to mitigate the impact of any remaining XSS attempts.

Generated by OpenCVE AI on May 1, 2026 at 13:46 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-6647	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList allows DOM-Based XSS. This issue affects m1.DownloadList: from n/a through 0.19.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList allows DOM-Based XSS. This issue affects m1.DownloadList: from n/a through 0.19.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-Based XSS.This issue affects m1.DownloadList: from n/a through <= 0.19.
References	https://patchstack.com/database/wordpress/plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00046}`	epss `{'score': 0.0007}`

Mar 17, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 15, 2025 10:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList allows DOM-Based XSS. This issue affects m1.DownloadList: from n/a through 0.19.
Title		WordPress m1.DownloadList plugin <= 0.19 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`