{"uuid": "bb127663-5ade-40bf-a33c-182b0dcc62c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1985", "type": "seen", "source": "https://t.me/hacking_Attack/56642", "content": "Exploit Collector\nWordPress Download Manager 3.2.42 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png \nWordPress Download Manager versions 3.2.42 and below suffer from a cross site scripting vulnerability.\n\nSHA-256 | 71c365c1622a8e8be5670614f48761ef15ae5b7520c2ac40a7223d816ce6545c\n\nDownload\nDescription: Reflected Cross-Site Scripting\n\nAffected Plugin: Download Manager\n\nPlugin Slug: download-manager\n\nPlugin Developer: codename065\n\nAffected Versions: <=\n\nCVE ID: CVE-2022-1985\n\nCVSS Score: 6.1 (Medium)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nResearcher/s: Rafie Muhammad (Yeraisci)\n\nFully Patched Version: 3.2.43\n\nDownload Manager is a file and document management plugin to help manage and control file downloads with various file download controls to restrict unauthorized file access. The plugin also provides a complete solution to sell digital products from WordPress sites, including checkout functionality to complete an order. One feature of the plugin is the ability to use a shortcode to embed files and other assets in a page or post. This function was found to be vulnerable to reflected Cross-Site Scripting.\n\nSecure coding practices would include checks to sanitize the input received by the page, and escaping that code on the output to ensure that only approved inputs and outputs are presented. Unfortunately, insufficient input sanitization and output escaping on the $_REQUEST[\u2018frameid\u2019] parameter found in the ~/src/Package/views/shortcode-iframe.php file of the Download Manager plugin made it possible for an attacker to run arbitrary code in a victim\u2019s browser by getting them to click on a specially crafted URL. This is due to the fact that the \u2018frameid\u2019 parameter was echoed to the page without sufficient user input validation.\n\nWithout proper sanitization and escaping in place on user-supplied inputs, JavaScript can be used to manipulate the page. Even an unsophisticated attacker could hijack the form and use it to trick a site administrator into unknowingly disclosing sensitive information, or to collect cookie values.\n\nMore specialized attackers would use this capability to gain administrator access or add a backdoor and take over the site. If the attacker gains this access, they would have access to the same information the administrator would be able to access, including user details and customer information.\n\nIn the case of Download Manager, customer information and access to digital products would both be at risk. If an attacker were able to trick an administrator into clicking a link that has been designed to send session cookies to the attacker, add a malicious administrator account, or implement a backdoor on the website, the attacker would also have free reign in the administrator panel, giving them the ability to modify checkout settings and even add fake products to the website.\n\nConclusion\n\nIn today\u2019s post, we discussed a reflected Cross-Site Scripting (XSS) vulnerability in Download Manager. While this would require tricking an administrator into clicking a link or performing some other action, it still offers the potential for site takeover. As such we urge you to update to the latest version of this plugin, 3.2.43 as of this writing, as soon as possible.\n\nAll Wordfence users, including Free, Premium, Care, and Response, are protected from exploits targeting this vulnerability.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:36.696176Z"}