What is the CVSS score of CVE-2026-86609?

CVE-2026-86609 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Download Manager Pro are affected by CVE-2026-86609?

Download Manager Pro for WordPress (Pro edition before 7.5.6) contains a stored cross-site scripting flaw in its email-locked download subscription form that can execute malicious scripts in an…. A patch is available.

Is there a public PoC exploit available for CVE-2026-86609?

Yes, a public proof-of-concept exploit is available for CVE-2026-86609. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-86609?

Vendor-released patch: 7.5.6. Within 24 hours, inventory all WordPress sites for the Download Manager Pro plugin and immediately update any instance running a version before 7.5.6 to 7.5.6; if immediate patching is not possible, disable the email-locked download subscription form or deactivate the Pro plugin until the update can be applied. Within 7 days, verify that every site is running 7.5.6 or later, confirm that only the Pro edition with the affected subscription form is in scope and the free plugin is not vulnerable, review admin-facing pages and web server logs for injected scripts or suspicious activity, enforce multi-factor authentication and least privilege for administrator accounts, and remove unused admin users. Within 30 days, integrate third-party WordPress plugin version tracking into vulnerability management, set patch SLAs for high-severity plugin flaws, conduct a broader review of installed plugins and their risk, test backup and restore procedures for rapid recovery, and train administrators to recognize and report unexpected content on admin pages.

Download Manager Pro CVE-2026-86609

EUVD-2026-87889 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-27 WPScan

GHSA-rr6w-vhh4-c36m

PHP WordPress XSS Download Manager Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Unauthenticated stored XSS firing in an admin browser: PR:N/UI:R, scope changes to the browser context (S:C), with limited C:L/I:L and no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 28, 2026 - 11:24 vuln.today

Metadata Corrected

Sep 28, 2026 - 02:40 vuln.today

tag: PHP added

Analysis Generated

Sep 28, 2026 - 02:30 vuln.today

Patch available

Sep 27, 2026 - 07:01 EUVD

CVE Published

Sep 27, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Sep 27, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.

Articles & Coverage 2

News 3 New WordPress Vulnerabilities - 3 High Severity, All With Public POC Sep 28, 2026 News 7 New PHP Vulnerabilities - 7 High Severity, All With POC Sep 28, 2026

AnalysisAI

Stored cross-site scripting in the commercial Download Manager Pro WordPress plugin (before version 7.5.6) allows an unauthenticated attacker to inject script payloads through the plugin's email-locked download subscription form, which are then rendered unsanitized on an administrator-facing page and execute in the admin's browser session. The free plugin distributed under the same slug does not ship the affected feature and is not vulnerable, so only sites running the Pro edition with that subscription form in use are exposed - and exploitation only completes when an administrator subsequently views the poisoned admin page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the commercial Download Manager Pro edition before 7.5.6 with the email-locked download subscription feature in use; the free plugin under the same slug does not ship the affected feature and is not vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and point to a moderate, not critical, priority despite the vendor's 8.8 CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Download Manager Pro to version 7.5.6 or later - this is the vendor-released fix and the only complete remediation; sites running the free plugin under the same slug need no action for this CVE. … Detailed patch versions, workarounds, and compensating controls in full report.