CVE-2026-12054 codename065 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Download Manager plugin should assess exposure and prioritize patching or mitigation. This includes security teams, IT administrators, and developers who manage WordPress environments. They should review official advisories, verify exposure, and apply patches or updates to prevent exploitation. Additionally, defenders should monitor for suspicious activity related to the 'REFERRER' parameter in the

Why it matters

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'REFERRER' parameter, allowing unauthenticated attackers to inject arbitrary web scripts.

• Defenders must verify exposure and apply patches or mitigations to prevent exploitation.
• Successful exploitation could lead to arbitrary web script execution in a victim's browser.
• Defenders should monitor for suspicious activity related to the 'REFERRER' parameter in the Download Manager plugin.
• Affected versions require verification from official sources.

Technical summary

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'REFERRER' parameter in all versions up to, and including, 3.3.57. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This could lead to unauthorized actions or data breaches if exploited. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation. The vulnerability is limited to DOM-based reflected cross-site scripting.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify exposure by checking if the Download Manager plugin version is 3.3.57 or earlier.
• Apply patches or updates to the Download Manager plugin to prevent exploitation.
• Monitor for suspicious activity related to the 'REFERRER' parameter in the Download Manager plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or affected versions beyond 3.3.57. Defenders should verify exposure by checking the Download Manager plugin version and review official advisories for accurate information. The vulnerability's impact is limited to DOM-based reflected cross-site scripting, and there are no reports of active exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.