What is GHSA-fc9h-r65m-ghj7?

GHSA-fc9h-r65m-ghj7 is a security advisory published by GitHub Security Advisories with Medium severity. The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ...

Which CVE IDs does GHSA-fc9h-r65m-ghj7 cover?

GHSA-fc9h-r65m-ghj7 covers the following CVE IDs: CVE-2026-12054. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fc9h-r65m-ghj7?

GHSA-fc9h-r65m-ghj7 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-fc9h-r65m-ghj7MediumCVSS 6.1

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-12054 →

📋 Description

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-12054
https://plugins.trac.wordpress.org/changeset/3573804/download-manager
https://www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140?source=cve
https://github.com/advisories/GHSA-fc9h-r65m-ghj7