CVE-2024-47341: WP-DownloadManager Reflected XSS Vulnerability

CVE-2024-47341 Overview

CVE-2024-47341 is a reflected cross-site scripting (XSS) vulnerability in the Lester Chan WP-DownloadManager plugin for WordPress. The flaw affects all versions up to and including 1.68.8. It stems from improper neutralization of user input during web page generation [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability carries a CVSS v3.1 score of 7.1 with a scope change, meaning the injected script can affect resources beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, or redirection to attacker-controlled sites.

Affected Products

Lester Chan WP-DownloadManager plugin for WordPress
All versions from n/a through 1.68.8
WordPress sites with the plugin enabled and reachable over the network

Discovery Timeline

2024-10-06 - CVE-2024-47341 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-47341

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the WP-DownloadManager WordPress plugin. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back in HTTP responses. An attacker constructs a URL containing a malicious JavaScript payload. When a user with an active session visits the URL, the browser renders the unescaped payload as executable script.

The scope change flag in the CVSS vector indicates the injected script can reach data outside the plugin's security boundary, including authenticated WordPress session cookies. Exploitation requires user interaction, typically through phishing or a malicious link in social media or email.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin echoes request parameters into HTML responses without applying context-appropriate output encoding such as esc_html(), esc_attr(), or esc_url() provided by the WordPress API. Standard WordPress sanitization helpers were either omitted or applied incorrectly on at least one reflected parameter.

Attack Vector

The attack is network-based and requires no privileges. An attacker crafts a URL targeting a vulnerable endpoint of the WP-DownloadManager plugin and embeds a JavaScript payload in a reflected parameter. The attacker delivers the URL through phishing, comment spam, or third-party links. When a victim, especially an authenticated administrator, opens the URL, the payload executes under the WordPress site's origin and can perform actions on behalf of the victim.

The vulnerability mechanism is documented in the Patchstack WP Download Manager Vulnerability advisory. No verified public proof-of-concept code was available at the time of writing.

Detection Methods for CVE-2024-47341

Indicators of Compromise

HTTP request logs containing URL parameters with <script>, javascript:, onerror=, or HTML-encoded variants targeting WP-DownloadManager endpoints
Referer headers pointing to attacker-controlled domains that direct users to plugin URLs with suspicious query strings
Unexpected administrative actions performed shortly after an admin clicked an external link
Outbound requests from administrator browsers to unknown domains immediately after visiting the WordPress site

Detection Strategies

Inspect WordPress access logs for requests to WP-DownloadManager URLs containing reflected payload patterns or URL-encoded script tags
Deploy a Web Application Firewall (WAF) with rules that flag XSS payloads in query string and POST body parameters
Use file integrity monitoring on the WordPress plugin directory to identify unauthorized changes

Monitoring Recommendations

Forward web server and WordPress audit logs to a centralized SIEM and alert on XSS pattern matches
Monitor administrator session activity for anomalous content changes, plugin installations, or user account creation
Track plugin version inventory across WordPress estates and alert when WP-DownloadManager is at or below version 1.68.8

How to Mitigate CVE-2024-47341

Immediate Actions Required

Identify all WordPress installations using WP-DownloadManager and confirm the installed version
Update WP-DownloadManager to a version above 1.68.8 once the vendor publishes a fix, per the Patchstack advisory
If no patch is available, disable and remove the plugin until a fixed release is published
Force a password reset and session invalidation for administrator accounts if exploitation is suspected

Patch Information

The vulnerability affects WP-DownloadManager versions up to and including 1.68.8. Site operators should monitor the plugin's WordPress.org page and the Patchstack advisory for the fixed version and apply it as soon as it is available.

Workarounds

Disable the WP-DownloadManager plugin until a patched version is installed
Deploy WAF rules that block requests containing XSS payloads targeting plugin endpoints
Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources
Restrict administrator access to the WordPress dashboard by source IP where feasible

bash

# Example WP-CLI commands to identify and deactivate the plugin
wp plugin list --name=wp-downloadmanager --fields=name,status,version
wp plugin deactivate wp-downloadmanager
wp plugin update wp-downloadmanager