Stored Cross-Site Scripting Vulnerability in Download Manager Pro WordPress Plugin
CVE-2026-86609
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86609?
The Download Manager Pro plugin for WordPress has a vulnerability that arises from inadequate data sanitization and escaping in its email-locked download subscription form. This flaw allows an unauthenticated attacker to inject malicious scripts, potentially leading to Stored Cross-Site Scripting (XSS) attacks targeting administrators when they view the admin page. It is critical for users of this plugin to upgrade to version 7.5.6 or higher to mitigate these risks.
Affected Version(s)
Download Manager 4.0.0 < 7.5.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.