EUVD-2026-42522
GHSA-v367-5mw9-22gq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim page view (UI:R); contributor auth required (PR:L); scope change affects victim browser session (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
AnalysisAI
Stored Cross-Site Scripting in the WordPress Download Manager plugin (all versions through 3.3.61) allows authenticated contributors to inject persistent JavaScript payloads via the 'note_before' and 'note_after' shortcode attributes. The root cause is an unescaped output sink in the shortcode renderer: although wp_kses_post filters post content on save for users lacking the unfiltered_html capability, kses-allowed tag and attribute combinations that survive filtering are passed directly to the unsafe sink and execute in victims' browsers when the injected page is rendered. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:codename065:download_manager:*:*:*:*:*:*:*:* - the 'Download Manager' WordPress plugin by codename065, versions through 3.3.61. The vulnerability is classed under CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The flaw exists in the shortcode implementation: contributor-level users supply values for the 'note_before' and 'note_after' shortcode attributes, which are processed through WordPress's wp_kses_post save-time filter but then rendered at the unescaped sink in src/User/views/reg-form.php (lines 69 and 78) and src/User/Register.php (lines 32 and 123), as surfaced in the WordPress plugin Trac source browser. Because wp_kses_post permits a defined subset of HTML tags and attributes (e.g., anchor tags, image tags with limited attributes), crafted payloads using only kses-allowed constructs can pass the save filter while still triggering JavaScript execution in the browser at the unescaped sink - a classic filter-bypass pattern for Stored XSS in WordPress plugins.
RemediationAI
Update the Download Manager plugin to the version released after changeset 3594267 in the WordPress plugin repository - the exact patched release version is not confirmed in the available input data, so verify the current version in the WordPress.org plugin directory before updating. The upstream fix is referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3594267%40download-manager&new=3594267%40download-manager. As a compensating control where immediate update is not possible, restrict contributor-level role assignment to fully trusted users, since the attack requires contributor or higher access; removing untrusted contributors eliminates the attack surface without plugin changes. Alternatively, disable or remove the Download Manager shortcode functionality via a code snippet or plugin manager until patching is feasible, though this will break download-related shortcode rendering site-wide. Enforcing a Web Application Firewall rule to strip or escape HTML tag attributes in shortcode parameter values is a partial control but may not cover all kses-bypass payloads.
More in Download Manager
View allAn issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receivin
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.
Unauth. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low at
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL co
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowin
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PH
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a downlo
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today