CVE-2026-1666

MEDIUM

Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-1666 has a selected CVSS score of 6.1 (medium).

Description

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 18, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Download Manager

Browse codename065 / Download Manager

Default status: unaffected

CVE ListThrough 3.3.46affected

References

6