CVE-2025-10146: Download Manager Plugin XSS Vulnerability

CVE-2025-10146 Overview

The Download Manager plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.3.23. The flaw exists in the user_ids parameter due to insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session theft, credential harvesting, forced administrative actions, or redirection to attacker-controlled resources.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a WordPress site by tricking authenticated users into clicking a crafted URL.

Affected Products

WordPress Download Manager plugin, all versions up to and including 3.3.23
WordPress sites with the plugin installed and active
Administrative and user-facing pages rendering the user_ids parameter

Discovery Timeline

2025-09-19 - CVE-2025-10146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10146

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the WordPress Download Manager plugin. The user_ids request parameter is reflected in server-generated HTML output without sufficient sanitization or contextual output escaping. When a victim visits a crafted URL, the injected script executes under the origin of the WordPress site.

Because exploitation requires user interaction and no authentication, attackers typically deliver the payload through phishing emails, malicious ads, forum posts, or social engineering. If the victim holds an administrative session, attackers can pivot from script execution to plugin installation, account creation, or content modification.

The CVSS scope change reflects the ability of injected script to affect resources beyond the vulnerable component, including cookies, tokens, and DOM state accessible from the browser context.

Root Cause

The root cause is missing input validation and improper output encoding when the user_ids parameter is echoed back into HTML. The affected code path is referenced in the plugin source at src/Admin/views/stats/history.php. User-supplied input reaches an HTML rendering context without escaping functions such as esc_attr() or esc_html() being applied.

Attack Vector

An attacker crafts a URL targeting a page that processes the user_ids parameter and embeds JavaScript within the value. The attacker distributes the URL to potential victims. When a victim with an active WordPress session clicks the link, the malicious script executes within the trusted origin, allowing the attacker to read cookies, submit authenticated requests, or manipulate the rendered page.

The vulnerability manifests when the user_ids parameter is reflected into HTML output. See the Wordfence Vulnerability Report and the WordPress Download Manager plugin source for technical details.

Detection Methods for CVE-2025-10146

Indicators of Compromise

HTTP requests containing the user_ids parameter with encoded or raw <script>, onerror=, onload=, or javascript: payloads
Referrers originating from external or untrusted domains linking directly to Download Manager admin pages
Unexpected outbound requests from administrator browsers to attacker-controlled domains following link clicks
Newly created WordPress administrator accounts or plugin installations without a corresponding admin action log

Detection Strategies

Inspect web server access logs for requests to Download Manager endpoints containing suspicious characters in user_ids, including <, >, %3C, %3E, and javascript:
Deploy a Web Application Firewall (WAF) rule to flag or block XSS patterns in query strings targeting the plugin
Correlate email gateway telemetry with WordPress access logs to identify phishing links referencing the vulnerable parameter

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to detect inline script execution attempts on WordPress pages
Alert on administrator session activity following clicks from external referrers
Monitor plugin file integrity and WordPress user table changes for unauthorized modifications

How to Mitigate CVE-2025-10146

Immediate Actions Required

Update the WordPress Download Manager plugin to a version later than 3.3.23 as soon as a patched release is available from the vendor
Restrict administrative access to the WordPress dashboard using IP allow-listing where feasible
Train administrators to avoid clicking unverified links while authenticated to the WordPress admin console

Patch Information

The vulnerability affects all versions up to and including 3.3.23. Site operators should monitor the WordPress Download Manager plugin page and the Wordfence advisory for the fixed release, then apply the update across all affected WordPress instances.

Workarounds

Deploy WAF rules that strip or block script-like content in the user_ids query parameter
Disable or remove the Download Manager plugin until a patched version is installed
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Example WAF rule (ModSecurity) to block XSS in user_ids parameter
SecRule ARGS:user_ids "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1010146,phase:2,deny,status:403,log,\
     msg:'CVE-2025-10146: XSS attempt in user_ids parameter'"