EUVD-2026-51751
GHSA-93pv-g4c5-fv9m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication required (PR:L); stored XSS auto-executes on page load without attacker-side user interaction (UI:N); injected script runs in victim browser scope (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
AnalysisAI
Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.
Technical ContextAI
The affected component is the Download Manager plugin for WordPress (CPE: cpe:2.3:a:codename065:download_manager:*:*:*:*:*:*:*:*), specifically the 'icon' attribute of the plugin's category/download shortcode, rendered through src/__/UI.php and src/Category/Shortcodes.php. The root cause aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant: the plugin relies on WordPress's wp_kses_post() for sanitization, which operates on raw post content at write time but does not process shortcode attribute values interpolated directly into HTML at render time. Source code visible in the WordPress plugin trac at UI.php#L81, category-shortcode-toolbar.php#L36 and #L17, and Shortcodes.php#L18 exposes the unescaped attribute echo path across both version 3.3.64 and 3.3.66 tags, confirming the issue persists through the latest affected release. The CVSS 3.1 Scope:Changed metric is appropriate because injected script executes in the victim's browser context, a security domain separate from the server-side WordPress application.
RemediationAI
An upstream fix has been committed to the WordPress plugin repository (changeset: https://plugins.trac.wordpress.org/changeset?reponame=&old=3628015%40download-manager&new=3628015%40download-manager); however, a specific released patched version number is NOT confirmed in the available input data - administrators should check the WordPress plugin directory for a version newer than 3.3.66 and update immediately once a tagged release is available. Do not assume the changeset alone indicates a deployed, installable patch. As a compensating control prior to patching, restrict contributor-role assignment to fully trusted users and audit existing contributor accounts for suspicious shortcode usage - removing contributor access broadly may disrupt editorial workflows. Site owners using a capability management plugin (e.g., Members, User Role Editor) can revoke shortcode publishing rights for the contributor role without disabling other editorial functions. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=cve for confirmation of the patched release version.
More in Download Manager
View allAn issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receivin
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.
Unauth. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low at
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL co
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowin
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PH
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a downlo
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today