Stored Cross-Site Scripting in Download Manager Plugin for WordPress

CVE-2026-16685

What is CVE-2026-16685?

The Download Manager plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to exploit insufficient input sanitization and output escaping. This issue arises from how the plugin's 'icon' shortcode attribute handles user input, permitting the injection of arbitrary web scripts into pages. The problem lies in the wp_kses_post() function, which fails to properly neutralize payloads at render time, making them executable when other users access these compromised pages. It's critical for site administrators to update their plugin to mitigate this risk.

References