CVE Catalog
CVE-2026-39615
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
The Download Manager plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
Risk of session theft, defacement, or theft of sensitive data from users visiting the infected page.
Recommendation
Update the Download Manager plugin to version 3.3.54 or later.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.