CVE-2026-120658: Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additionalpreviews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpdmsanitizearray() function strips HTML tags via wpkses but leaves bare single quotes intact and calls stripslashesdeep() which defeats WordPress magic quotes protection, allowing a single-quote-based attribute breakout payload to be stored verbatim and later rendered without escaping.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Author-level permissions or higher. Unauthenticated visitors and users below the Author role are not identified as able to submit the malicious payload.
What must occur for the injected script to run?
The attacker must store a single-quote-based attribute-breakout payload through the file[additional_previews][] parameter. The script executes when a user accesses the page containing the injected content.
Are installations running version 7.6.3 affected?
Yes. The affected range includes Download Manager versions up to and including 7.6.3.
How does the vulnerable input handling enable the attack?
The wpdm_sanitize_array() function removes HTML tags but leaves bare single quotes intact, then calls stripslashes_deep(). This defeats WordPress magic-quotes protection, allowing the payload to be stored and later rendered without escaping.