What is the CVSS score of EUVD-2026-51751?

EUVD-2026-51751 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Download Manager EUVD-2026-51751

| CVE-2026-16685 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 Wordfence

GHSA-93pv-g4c5-fv9m

WordPress XSS Download Manager Wordpress Plugin Codename065

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Contributor authentication required (PR:L); stored XSS auto-executes on page load without attacker-side user interaction (UI:N); injected script runs in victim browser scope (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:56 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.

AnalysisAI

Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.

Technical ContextAI

The affected component is the Download Manager plugin for WordPress (CPE: cpe:2.3:a:codename065:download_manager:*:*:*:*:*:*:*:*), specifically the 'icon' attribute of the plugin's category/download shortcode, rendered through src/__/UI.php and src/Category/Shortcodes.php. The root cause aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant: the plugin relies on WordPress's wp_kses_post() for sanitization, which operates on raw post content at write time but does not process shortcode attribute values interpolated directly into HTML at render time. Source code visible in the WordPress plugin trac at UI.php#L81, category-shortcode-toolbar.php#L36 and #L17, and Shortcodes.php#L18 exposes the unescaped attribute echo path across both version 3.3.64 and 3.3.66 tags, confirming the issue persists through the latest affected release. The CVSS 3.1 Scope:Changed metric is appropriate because injected script executes in the victim's browser context, a security domain separate from the server-side WordPress application.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository (changeset: https://plugins.trac.wordpress.org/changeset?reponame=&old=3628015%40download-manager&new=3628015%40download-manager); however, a specific released patched version number is NOT confirmed in the available input data - administrators should check the WordPress plugin directory for a version newer than 3.3.66 and update immediately once a tagged release is available. Do not assume the changeset alone indicates a deployed, installable patch. As a compensating control prior to patching, restrict contributor-role assignment to fully trusted users and audit existing contributor accounts for suspicious shortcode usage - removing contributor access broadly may disrupt editorial workflows. Site owners using a capability management plugin (e.g., Members, User Role Editor) can revoke shortcode publishing rights for the contributor role without disabling other editorial functions. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=cve for confirmation of the patched release version.