CVE-2026-86610

MediumCVSS 6.4

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected.

Risk Assessment

Attackers can execute arbitrary JavaScript in the victim's browser, including administrators, potentially leading to account takeover or data theft. The risk is high because the attack can target privileged users.

Recommendation

Update the Download Manager plugin to version 3.3.71 or later and consider upgrading PHP to version 8.1 or later. An audit of content for malicious scripts is also recommended.

Other vulnerabilities in Download Manager WordPress plugin

CVE-2026-14235High
The Download Manager WordPress plugin before version 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly. The token becomes a long-lived, multi-use, portable bearer token. An attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

Original NVD description (English source)

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS