Vulnerabilities / Download Manager / WPSEC-2026-0246
Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting via Package Icon URL
Medium 6.4
CWE-79Fixed in 3.3.71
- ID
- WPSEC-2026-0246
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.71
- Remediation
- Update to 3.3.71 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the package icon URL in all versions up to, and including, 3.3.70. This is due to the icon URL being placed into a single-quoted img src attribute in the package lock dialog without output escaping, while the save routine's HTML encoding leaves single quotes intact on PHP versions before 8.1. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user opens the download dialog of the affected package.
References
- https://wpsec.com/vuln/WPSEC-2026-0246/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.71/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS