CVE-2025-3056

Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published Apr 18, 2025 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Analysis

Technical impact

The vulnerability allows an authenticated user with Author or higher privileges to upload an SVG file that contains malicious scripts. Because the Download Manager plugin fails to sanitize or escape the SVG content, the scripts are stored and executed whenever the file is rendered, resulting in arbitrary client‑side code execution.

Affected Systems

The WordPress plugin Download Manager, developed by codename065, is affected in all releases up to and including version 3.3.12.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to authenticate with Author‑level or higher access, upload a crafted SVG file, and rely on the script executing in other users’ browsers when they open the file via the plugin’s file upload interface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

codename065

Download Manager

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.3.12

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Download Manager to version 3.3.13 or later to remove the stored XSS flaw.
If an immediate upgrade is not possible, disable SVG uploads entirely or enforce a strict MIME type whitelist that excludes SVG files from being stored.
Deploy a Content‑Security‑Policy that blocks inline scripts and restricts script sources to trusted origins to mitigate any residual XSS risk.

Generated by OpenCVE AI on April 21, 2026 at 21:15 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-11832	The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.381% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3275196/
https://wordpress.org/plugins/download-manager/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8?source=cve

History

Feb 27, 2026 2:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 18, 2025 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Title		Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/changeset/3275196/ https://wordpress.org/plugins/download-manager/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8?source=cve
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`