Stored Cross-Site Scripting Vulnerability in Download Manager Plugin by WordPress
CVE-2026-86610

Currently unrated

Key Information:

Vendor

WordPress
Status
Download Manager
Vendor
CVE Published:
1 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86610?

The Download Manager plugin for WordPress prior to version 3.3.71 has a vulnerability that arises from inadequate sanitization of user inputs. This allows users with the Author role or higher to exploit the system by injecting malicious scripts into the package settings. When a visitor accesses the download dialogue for a compromised package, the injected scripts can execute in their browser. This vulnerability primarily affects websites running PHP versions lower than 8.1, as the sanitization implemented during the saving of settings does not adequately handle single quotes.

Affected Version(s)

Download Manager 0 < 3.3.71

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86610 - Proof of Concept

References

https://wpscan.com/vulnerability/eba10cea-445e-4707-ba99-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mark Moore
WPScan
.