WordPress Download Manager CVE-2026-9696

Exploitation requires an authenticated account with Contributor-level privileges or higher on the target WordPress site (PR:L), and the payload is delivered through the 'not_found' parameter handled by Download Manager's shortcode processing (src/Package/Shortcodes.php). The stored script executes when any user subsequently views the injected page. Limiting factors: this cannot be exploited by unauthenticated or Subscriber-only users, so sites that do not grant Contributor accounts to untrusted parties (e.g., single-author or admin-only blogs) face sharply reduced risk; affected versions are 3.3.58 and earlier, with the fix in 3.3.59.

This is a moderate-severity, authenticated Stored XSS (CWE-79) in the WordPress Download Manager plugin, with a provided CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The network vector and low attack complexity favor exploitation, but the PR:L requirement meaningfully constrains real-world risk: an attacker needs at least Contributor-level access to the WordPress site, so this is not an unauthenticated internet-facing flaw. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence set, so there is no signal of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (a scope-change stored XSS with limited C/I impact and no availability impact maps cleanly to 6.4), with no contradiction between the CVSS vector and the description. Overall this is a 'genuine but not emergency' issue: dangerous on multi-author sites where low-trust Contributor accounts exist, but low priority on single-admin or tightly-controlled installations. The main unknown is the absence of exploitation-probability data (EPSS) and vendor/CISA exploitation confirmation.

On a multi-author WordPress site running Download Manager 3.3.58 or earlier, an attacker who holds (or phishes/registers into) a Contributor account submits content containing a malicious payload in the 'not_found' parameter of a Download Manager shortcode. Because input is insufficiently sanitized and output is not escaped, the script is stored and later executes in the browser of any user - including a higher-privileged administrator - who views the affected page, enabling session theft or admin-action abuse. No public exploit code was identified, so an attacker would need to craft the payload manually.