Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-86609: Download Manager Pro lets attackers inject scripts into admin page
CVE-2026-86609 · published 22 days ago
Summary
The Download Manager Pro WordPress plugin (versions before 7.5.6) fails to clean data entered through its email‑locked download subscription form. This lets unauthenticated users place malicious code that runs whenever an administrator views the page, potentially stealing data or taking control of the admin session. Upgrade to version 7.5.6 or later, or disable the email‑locked download feature, to protect your site.
What to do
- Update unknown download manager to version 7.5.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | download manager | < 7.5.6 |
Original advisory text
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Track software like this
Free during beta