WP File Download CVE-2026-39799

Exploitation requires an attacker (no authentication needed, per PR:N) to deliver a crafted XSS payload through the WP File Download plugin and have a victim user interact with it - viewing or clicking attacker-controlled content (UI:R) - at which point script executes in the victim's authenticated browser session. The description does not specify the exact vulnerable feature, parameter, or whether the flaw is stored or reflected, so the precise trigger surface is not confirmed from available data. Key limiting factors: the mandatory user interaction, the need for the plugin (versions <= 6.3.6) to be installed and reachable, and that meaningful impact (e.g., admin takeover) depends on luring a privileged victim rather than an arbitrary visitor.

This is a moderate-severity (CVSS 7.1) unauthenticated Cross-Site Scripting flaw in the WP File Download WordPress plugin (JoomUnited) in versions up to and including 6.3.6, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L confirms a network-based, low-complexity, unauthenticated attack (PR:N) that nonetheless REQUIRES user interaction (UI:R) - a victim must be lured into viewing or clicking attacker-controlled content, which materially lowers real-world exploitability versus a no-interaction flaw. The scope change (S:C) and low impacts across C/I/A are typical of XSS executing in the victim's browser context rather than directly compromising the server. No EPSS score, CISA KEV listing, or public exploit code is present in the provided intelligence, so there is no evidence of active exploitation - this is a high-CVSS-but-interaction-gated issue rather than a confirmed mass-exploitation priority. The practical risk is highest where the plugin is exposed to untrusted users and a privileged victim (e.g., an administrator) can be socially engineered, enabling session/credential theft or admin-context actions. Note: EPSS and POC status are entirely absent from the input, so widespread-exploitation likelihood cannot be quantified and should be treated as unknown rather than low.

An unauthenticated attacker crafts a malicious payload (link or injected content) targeting the vulnerable WP File Download functionality and lures a logged-in user - ideally a site administrator - into viewing it. When the victim's browser renders the page, the attacker's JavaScript executes in the WordPress session context, allowing theft of session cookies or forced admin actions. No public exploit code is identified in the provided data at time of analysis, and successful exploitation hinges on the required user interaction.