CVE-2022-2101

The Download Manager plugin contains a stored cross-site scripting vulnerability in versions through 3.2.46 affecting the `file[files][]` parameter. Authenticated users with contributor privileges or higher can inject malicious scripts into file pages due to inadequate sanitization and escaping of inputs. These injected scripts execute when administrators visit the editor interface for the compromised file, allowing attackers to perform unauthorized actions with administrative privileges. The issue was resolved in version 3.2.47.

Based on public CVE data (MITRE/NVD).