Executive brief
The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users or administrators visit the affected pages. This could lead to unauthorized actions being performed in the context of a victim's browser, potentially compromising user sessions or site content.
Technical details
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'note_before' and 'note_after' shortcode attributes. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into pages. While WordPress's 'wp_kses_post' function filters some content for users without 'unfiltered_html' capabilities, certain payloads can still bypass these filters and reach an unsafe unescaped sink. When a user views the page where the shortcode is rendered, the malicious script executes in their browser. The vulnerability is present in all versions up to and including 3.3.61.
Affected products
- codename065 Download Manager up to, and including, 3.3.61
Timeline
- 2026-07-09: disclosed
- 2026-07-09: advisory
References
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php
- https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3594267%40download-manager&new=3594267%40download-manager
- https://www.wordfence.com/threat-intel/vulnerabilities/id/74cd34be-008c-4ff3-ae3c-417cfd2fee9b?source=cve