Stored Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress

CVE-2026-5357

What is CVE-2026-5357?

The Download Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'sid' parameter in the 'wpdm_members' shortcode. This vulnerability arises from inadequate input sanitization and output escaping within the members() function. The 'sid' parameter, utilized for managing user sessions, can be manipulated by authenticated users with contributor-level access or higher. When injected, these malicious scripts are stored and directly output into HTML attributes, leading to potential web script execution whenever the impacted page is loaded. This risk emphasizes the necessity for enhanced validation and sanitization methods to protect user data and maintain security integrity.

References