CVE-2026-9696: Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-10 · updated 2026-10-13
Weakness: CWE-79

Description

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

codename065 Download Manager: through 3.3.58

References

https://plugins.trac.wordpress.org/changeset?old_path=download-manager/tags/3.3.58/src/Package/Shortcodes.php&old=3574454&new_path=download-manager/tags/3.3.59/src/Package/Shortcodes.php&new=3588497
https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e11e8-de23-469e-9b96-3fc24b03bf98?source=cve

Get alerted when CVE-2026-9696 or the next vulnerability affects your stack