Description The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. References https://wordpress.org/plugins/dwnldr/#developers https://rastating.github.io/dwnldr-1-0-stored-xss-disclosure/