Executive brief
The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with 'Author' privileges to inject malicious scripts into file titles. When other users, including site administrators or regular visitors, view the page containing the affected file, the malicious script will run in their browser. This could lead to unauthorized actions being performed on behalf of the victim, such as stealing session information or redirecting users to malicious websites.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Download Manager plugin for WordPress in versions prior to 3.3.66. The issue stems from the plugin's failure to properly escape package titles before rendering them in front-end templates. An attacker with at least 'Author' role privileges can save a package with a title containing arbitrary JavaScript. This script is then executed in the context of any user's browser who visits the page where the package is displayed. The vulnerability is tracked as CWE-79 and was addressed in version 3.3.66.
Affected products
- WPDM Download Manager < 3.3.66
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Fixed in version 3.3.66
- 2026-08-01: advisory