Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1666 Reflected XSS Vulnerability in WordPress Download Manager Plugin <= 3.3.46 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1666
Post summary
The post announces CVE-2026-1666 as a reflected XSS vulnerability affecting WordPress Download Manager Plugin versions up to 3.3.46, without mentioning any PoC, exploitation, or patch details.
CVE-2026-1666 The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. … https://www.cve.org/CVERecord?id=CVE-2026-1666
Post summary
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting through the 'redirect_to' parameter in all versions up to 3.3.46.