CVE-2026-1666

Description

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PUBLISHED Reserved 2026-01-29 | Published 2026-02-18 | Updated 2026-02-18 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Jack Taylor finder

References

www.wordfence.com/...-b403-4a9d-b1a7-92aa947310ac?source=cve

plugins.trac.wordpress.org/...tags/3.3.46/src/User/Login.php

plugins.trac.wordpress.org/.../src/User/views/login-form.php

www.wpdownloadmanager.com/...orm-user-login-form-short-code/

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2026-1666)

nvd.nist.gov (CVE-2026-1666)

Download JSON