Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-16685: Download Manager <= 3.3.66 - Attackers can inject malicious scripts

CVE-2026-16685 · published 3 months ago

Summary

The Download Manager plugin for WordPress has a security flaw that allows attackers with contributor-level access and above to inject malicious code into pages. This code will execute when users visit those pages, potentially allowing the attacker to steal information or take control of the website. Update the plugin to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
codename065	download manager	<= 3.3.66

Original advisory text

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published1 Aug 2026

Updated4 Nov 2026

First seen1 Aug 2026

Sources

CVE-2026-16685 · NVD

CVE-2026-16685 · MITRE

Track software like this

Free during beta