CVE-2025-3056: Download Manager WordPress Plugin XSS Flaw

CVE-2025-3056 Overview

CVE-2025-3056 is a Stored Cross-Site Scripting (XSS) vulnerability in the Download Manager plugin for WordPress. The flaw affects all versions up to and including 3.3.12. It results from insufficient input sanitization and output escaping when handling Scalable Vector Graphics (SVG) file uploads. Authenticated users with Author-level access or higher can upload SVG files containing embedded JavaScript. When another user accesses the SVG file, the injected script executes in that user's browser context. The weakness is tracked as CWE-79.

Critical Impact
Authenticated attackers with Author-level access can inject arbitrary JavaScript through SVG uploads, enabling session theft, administrative action forgery, and browser-based attacks against site visitors.

Affected Products

WordPress Download Manager plugin, versions up to and including 3.3.12
WordPress sites permitting SVG uploads through the plugin
Environments granting Author-level or higher roles to untrusted users

Discovery Timeline

2025-04-18 - CVE-2025-3056 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3056

Vulnerability Analysis

The Download Manager plugin accepts SVG files as uploadable download assets. SVG is an XML-based image format that supports embedded <script> elements and JavaScript event handlers such as onload and onclick. The plugin does not strip or neutralize these executable elements before serving the file. When a user opens the SVG directly in a browser, the browser parses it as XML and executes any embedded script under the origin of the WordPress site.

Because the script runs in the site's origin, it has access to cookies, session storage, and the Document Object Model (DOM) of same-origin pages. Attackers can pivot to administrative actions if an administrator loads the malicious file.

Root Cause

The plugin fails to perform two required controls. First, it does not sanitize the SVG body to remove scriptable elements before storage. Second, it does not enforce a safe content-type or Content-Disposition: attachment header on delivery. This combination allows the browser to render user-supplied XML as active content. The requirement for Author-level authentication limits the attacker pool but does not prevent exploitation on multi-author sites.

Attack Vector

An attacker with Author privileges authenticates to the WordPress dashboard and uploads a crafted SVG through the Download Manager interface. The SVG contains a <script> element or an event handler on an SVG shape. The attacker then shares the direct file URL, embeds it in a post, or waits for administrators to review uploaded content. When the victim retrieves the SVG, the browser executes the payload, and the attacker can exfiltrate session cookies, issue authenticated REST API requests, or drop persistent web shells through plugin editors if an administrator is targeted.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-3056

Indicators of Compromise

SVG files in the WordPress uploads directory containing <script> tags, javascript: URIs, or event handler attributes such as onload, onerror, or onclick
Unexpected outbound requests from administrator sessions to attacker-controlled domains following SVG access
New administrator accounts, modified plugin or theme files, or altered wp_options entries created shortly after SVG uploads by Author-role users

Detection Strategies

Scan the WordPress wp-content/uploads/download-manager-files/ directory for SVG files and grep for scriptable XML elements
Review Download Manager audit logs for uploads originating from Author or Contributor accounts
Correlate WordPress access logs showing SVG file retrievals with subsequent privileged actions in the same session

Monitoring Recommendations

Alert on any SVG file uploaded through plugin endpoints and quarantine pending review
Monitor for role changes, user creation, and plugin installation events immediately following media uploads
Track browser Content Security Policy (CSP) violation reports for inline script execution on media URLs

How to Mitigate CVE-2025-3056

Immediate Actions Required

Update the Download Manager plugin to the version released in WordPress changeset 3275196, which is later than 3.3.12
Audit all SVG files under WordPress uploads directories and remove any containing script or event handler content
Restrict Author-level and above accounts to trusted users and enforce multi-factor authentication for all editorial roles

Patch Information

The vendor addressed the flaw in a release tracked by WordPress changeset 3275196. Administrators should update through the WordPress plugin dashboard or download the fixed release from the Download Manager Plugin Repository. Verify the installed version is greater than 3.3.12 after the update.

Workarounds

Disable SVG uploads entirely at the WordPress level until the plugin is patched
Serve uploaded SVG files with a Content-Disposition: attachment header to force download rather than inline rendering
Apply a strict Content Security Policy that blocks inline scripts on media response paths

bash

# Nginx configuration to force SVG downloads and block inline execution
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}