Download Manager <= 3.2.42 - Reflected Cross-Site Scripting

Description

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.

Scores

EPSS (exploitation in 30 days)

1.2% · top 32% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• codename065 · Download Manager

  • affected ≤ 3.2.42

References (5)

• https://www.wordfence.com/threat-intel/vulnerabilities/id/79fcf18e-39f7-42f2-90e4-3a5bac3382e0?source=cve (opens in a new tab)x_transferred
• https://wordpress.org/plugins/download-manager/#developers (opens in a new tab)x_transferred
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2736071%40download-manager&new=2736071%40download-manager&sfp_email=&sfph_mail= (opens in a new tab)x_transferred
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1985 (opens in a new tab)x_transferred
• https://www.wordfence.com/blog/2022/06/security-vulnerability-download-manager-plugin/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-1985](https://trackcve.app/badge/CVE-2022-1985.svg)](https://trackcve.app/cve/CVE-2022-1985)

Record last updated 8 Apr 2026, 17:02 UTC.