Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
- ID
- WPSEC-2026-0244
- Plugin
- Download Manager (download-manager)
- Affected
- from 3.3.26 before 3.3.71
- Remediation
- Update to 3.3.71 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-97338, on 2026-10-01.
Description
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in versions 3.3.26 up to, and including, 3.3.70. This is due to the Download History user filter disabling Select2's markup escaping, so entity-encoded markup stored in a display name is turned back into live HTML when the filter is rendered with that user selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute when an administrator filters the Download History by the attacker's account, for example by clicking the attacker's name in the history table.
References
- https://wpsec.com/vuln/WPSEC-2026-0244/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.71/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS