What is the CVSS score of CVE-2026-5357?

CVE-2026-5357 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-5357

EUVD-2026-20839 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 Wordfence

GHSA-cwf6-258p-c2v5

WordPress PHP XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20839

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdm_members' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

AnalysisAI

Stored cross-site scripting in Download Manager for WordPress up to version 3.3.52 allows authenticated contributors and above to inject arbitrary JavaScript through the 'sid' parameter of the 'wpdm_members' shortcode, which is stored in post metadata and executed when users access the affected page. The vulnerability stems from missing input sanitization in the members() function and absent output escaping (esc_attr()) when the 'sid' value is rendered directly into HTML id attributes. EPSS score indicates moderate-to-high exploitation probability; no active exploitation in CISA KEV has been confirmed at time of analysis.

Technical ContextAI

The Download Manager plugin for WordPress (CPE: cpe:2.3:a:codename065:download_manager:*:*:*:*:*:*:*:*) implements the 'wpdm_members' shortcode to display user member information. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. The members() function in User.php extracts the 'sid' shortcode parameter without sanitization and stores it via update_post_meta(), persisting the untrusted data in the WordPress post metadata table. When the members.php template renders this stored value into an HTML id attribute without applying WordPress's esc_attr() escaping function, the browser interprets injected script tags or event handler attributes as executable code. This affects the WordPress plugin ecosystem where shortcodes are frequently used across multiple pages, multiplying the attack surface.

RemediationAI

The vendor should release a patched version of Download Manager that applies WordPress's esc_attr() function to the 'sid' parameter when rendering the HTML id attribute in members.php, and implements input sanitization using sanitize_text_field() or equivalent in the members() function at the point of extraction and storage. Users should upgrade to the patched version once available; in the interim, restrict contributor-level access to trusted administrators only, and audit existing posts and pages for suspicious 'wpdm_members' shortcodes with unusual 'sid' values containing HTML entities or script tags. Reference the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/27fc81b0-c03a-4de7-bc38-791401d1685b?source=cve for updates and the plugin repository changelogs for release notes.