{
 "id": "WPSEC-2026-2749",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2749/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2749/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2749/index.md",
 "title": "Download Manager <= 3.3.75 - Authenticated (Author+) Stored Cross-Site Scripting via Additional Preview and Video Links",
 "description": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a package's additional preview image and video links in all versions up to, and including, 3.3.75. This is due to insufficient input sanitization of the preview and file values on save, which keeps quote characters, and missing output escaping when they are printed into single-quoted href and src attributes. This makes it possible for authenticated attackers with author-level access or above (users who can edit a package and upload files) to inject arbitrary web scripts that execute whenever a user views the affected package page.",
 "plugin": {
  "slug": "download-manager",
  "name": "Download Manager",
  "full_name": "Download Manager",
  "wordpress_org": "https://wordpress.org/plugins/download-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/download-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/download-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.76",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.76"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.76",
 "remediation": "Update to 3.3.76 or later.",
 "fix_released": "2026-11-07T17:35:10+00:00",
 "published": "2026-11-08T17:40:50+00:00",
 "updated": "2026-11-08T13:07:26.130719+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2749/",
  "https://plugins.svn.wordpress.org/download-manager/tags/3.3.76/",
  "https://wordpress.org/plugins/download-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/download-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-08"
 }
}