Download Manager <= 3.3.75 - Authenticated (Author+) Stored Cross-Site Scripting via Additional Preview and Video Links
- ID
- WPSEC-2026-2749
- Plugin
- Download Manager (download-manager)
- Affected
- all versions before 3.3.76
- Remediation
- Update to 3.3.76 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-08
- Attack surface
- Download Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a package's additional preview image and video links in all versions up to, and including, 3.3.75. This is due to insufficient input sanitization of the preview and file values on save, which keeps quote characters, and missing output escaping when they are printed into single-quoted href and src attributes. This makes it possible for authenticated attackers with author-level access or above (users who can edit a package and upload files) to inject arbitrary web scripts that execute whenever a user views the affected package page.
References
- https://wpsec.com/vuln/WPSEC-2026-2749/
- https://plugins.svn.wordpress.org/download-manager/tags/3.3.76/
- https://wordpress.org/plugins/download-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS