Download Manager CVE-2026-102401

Requires an authenticated WordPress account with contributor-level capability or higher (PR:L) on a site running the Download Manager plugin version ≤3.3.71; the attacker injects via the 'regurl' parameter handled by the plugin's User/Login flow. Exploitation is further LIMITED in two ways: the malicious script only fires for logged-out site visitors, since the vulnerable login-form.php template branch is gated on !is_user_logged_in() and authenticated viewers receive a different, unaffected template - so impact is confined to anonymous traffic. Practically, risk is concentrated on sites that permit low-trust users to register or hold contributor roles; a locked-down site with no untrusted contributors has little exposure.

This is a moderate-severity Stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world urgency is tempered by two structural limits. First, the CVSS vector confirms exploitation requires authentication (PR:L) - specifically contributor-level access or above - so this is not an unauthenticated internet-wide threat; it presupposes an attacker who already holds a (possibly self-registered or low-trust) content-contributor account. Second, per the description the injected payload only executes for logged-out visitors because the vulnerable login-form.php branch is gated on !is_user_logged_in(), narrowing the victim population to anonymous site traffic. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (network-reachable stored injection by a low-privilege authenticated user), so this is a genuine but not emergency priority: patch in normal cycle, prioritized on sites that allow untrusted contributor registration. It is not a high-CVSS-but-illusory issue, but neither does it warrant out-of-band response absent exploitation evidence.

An attacker obtains or is granted a contributor-level WordPress account on a site running Download Manager ≤3.3.71 and submits a malicious 'regurl' value containing a script payload that is stored without sanitization. When an anonymous (logged-out) visitor later loads the affected login-form page, the payload executes in their browser, enabling session/credential theft or redirects. No public exploit code was identified in the provided data, and the low attack complexity means a working account is the main prerequisite.