Stored Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress

CVE-2026-119156

What is CVE-2026-119156?

The Download Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output encoding. Unauthenticated attackers can exploit this weakness through the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameters in versions up to and including 7.5.9. This allows maliciously crafted scripts to be injected into web pages, executing whenever a user accesses the affected content. The vulnerability exploits a configuration where 'Anyone can register' is enabled, the plugin's [wpdm_reg_form] shortcode is present on a public page, and a package associated with user ID 1 is rendered using the Spotlight link template.

References