WordPress Download Manager CVE-2026-12054

Exploitation requires an attacker to lure a victim into loading a crafted request containing a malicious payload in the 'REFERRER' GET parameter of the Download Manager plugin, which is reflected without sufficient sanitization or output escaping. It is unauthenticated (PR:N), so no WordPress account is needed, but it depends on victim interaction (UI:R) - the target must click or load the attacker-controlled link, limiting this to phishing/social-engineering delivery rather than silent mass exploitation. Applies to all Download Manager versions up to and including 3.3.57; patched builds are not affected.

This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that realistically sits in the 'high-prevalence product but limited impact' category rather than a top-priority emergency. The positive signals are network attack vector, low complexity, and no privileges required (PR:N, so unauthenticated), which lowers the bar for an attacker. The key mitigating signal is UI:R - exploitation requires a victim to interact with an attacker-crafted request, which caps mass-automated exploitation. No EPSS score was supplied in the input, no CISA KEV listing is present, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Reflected XSS of this kind is typically opportunistic/phishing-driven rather than self-propagating. Net: patch during normal cycles given the broad WordPress plugin footprint, but this is not a confirmed-exploited, drop-everything issue. EPSS is absent (not low) - treat exploitation probability as unquantified rather than assuming it is negligible.

An attacker crafts a malicious URL for a vulnerable site that embeds JavaScript in the 'REFERRER' parameter and delivers it to a victim via phishing, a forum post, or a malicious link. When the victim clicks the link, the unsanitized parameter is reflected into the page and the script executes in the victim's browser session, enabling session/cookie theft or actions in the WordPress context. No public exploit code was identified at time of analysis, but reflected XSS of this type is trivial to weaponize given AV:N/AC:L.