The Download Manager plugin is vulnerable to reflected cross‑site scripting in all releases up to 3.3.46 due to the lack of sanitization and escaping of the 'redirect_to' GET parameter on the login form shortcode. An unauthenticated attacker can embed arbitrary script content that is executed when a victim opens a crafted link, enabling cookie theft, defacement, or further exploitation of the victim's session.

WordPress sites running the codename065 Download Manager plugin, specifically any version 3.3.46 or older.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires only a malicious URL and an unsuspecting user to visit it, meaning it is exploitable in a web context without authentication. While the exploitation surface is limited to a single parameter, once a victim’s browser processes the injected script the attacker gains the same privileges as the user, potentially compromising confidentiality and integrity of their session data.