Download Manager CVE-2026-86610

Exploitation requires ALL of: (1) the site runs PHP below 8.1 - on PHP 8.1+ the save-time sanitisation neutralises single quotes and the attack fails; (2) an authenticated account with the WordPress Author role or higher to create/edit a Download Manager package and set the vulnerable package setting; (3) Download Manager plugin version before 3.3.71; and (4) victim interaction - an administrator or other visitor must open the affected package's download dialogue for the stored payload to fire. The PHP-version gate and the authenticated-author requirement are the primary limiting factors that sharply reduce real-world exploitability on modern, supported deployments.

This is a genuine but conditional stored-XSS issue, not a widespread emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.4) is network-reachable but heavily gated: it requires an authenticated contributor, victim interaction (UI:R), and high attack complexity (AC:H) reflecting the narrow precondition that the host runs PHP below 8.1. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The main conflict is in the vector's privilege and impact framing: the description says the attacker only needs the 'Author role and above,' which is a low-privilege authenticated WordPress role (PR:L), yet WPScan rated it PR:H; and the C:H/I:H/A:H impacts appear to extrapolate full-site compromise from an administrator executing the injected script rather than scoring the XSS's direct browser-context impact (typically C:L/I:L with scope change). Net real-world risk is medium-low: the PHP<8.1 requirement excludes modern, supported stacks (PHP 8.1 reached EOL considerations but remains the floor here), and an Author-level account plus admin victim interaction is needed, so this is a privilege-escalation/account-takeover vector in legacy deployments rather than a mass-exploitable unauthenticated flaw.

On a WordPress site running PHP below 8.1, an attacker who holds (or phishes/registers into) an Author-or-above account saves a malicious script payload into a Download Manager package setting, where single quotes are not neutralised on save. When an administrator or any visitor later opens that package's download dialogue, the stored script executes in their browser, enabling session/cookie theft or admin-context actions leading to full site takeover. No public exploit code was identified, and successful execution depends on the PHP<8.1 condition and the victim opening the dialogue.