EUVD-2026-20253
GHSA-rg5f-p7fv-c42m
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.
AnalysisAI
Stored XSS in Shahjada Download Manager WordPress plugin versions up to 3.3.53 allows authenticated administrators with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (UI:R) and high administrative privileges (PR:H), limiting real-world attack surface; EPSS exploitation probability is exceptionally low at 0.03% (8th percentile), indicating minimal practical risk despite the stored nature of the vulnerability.
Technical ContextAI
The vulnerability stems from improper input neutralization during web page generation (CWE-79), a classic stored cross-site scripting flaw in the Download Manager WordPress plugin. The plugin fails to adequately sanitize or escape user-supplied input before storing it in the database and rendering it on web pages. WordPress plugins typically process user input through various endpoints (custom post types, settings pages, file metadata) without sufficient output encoding, allowing attackers with administrative credentials to persist malicious JavaScript payloads that execute when other users view affected pages. The CPE string cpe:2.3:a:shahjada:download_manager:*:*:*:*:*:*:* identifies all versions of the Shahjada Download Manager product line as potentially vulnerable.
RemediationAI
Update Shahjada Download Manager to a version newer than 3.3.53 immediately; consult the official Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-cross-site-scripting-xss-vulnerability?_s_id=cve for patch availability and exact version details. If an immediate patch is unavailable, restrict administrative access to trusted users only, disable the Download Manager plugin until a patch is released, and review administrative audit logs for any suspicious file uploads or metadata modifications. The NIST NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-39615) may provide additional vendor response information.
More in Download Manager
View allAn issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receivin
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.
Unauth. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low at
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL co
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowin
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PH
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a downlo
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today