CVE-2026-39799: WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

No authentication is required. Exploitation is network-accessible, but it requires a user to interact with attacker-supplied content.

Q: What is the potential impact if the vulnerability is exploited?

Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The CVSS vector also indicates scope may extend beyond the vulnerable plugin's security authority.

Q: Which installations should be considered affected?

Installations running JoomUnited WP File Download version 6.3.6 or earlier should be considered affected based on the available information.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

Affected Software

1 affected component

JoomUnited WP File Download<=6.3.6

Event History

Oct 10, 2026

CVE Published

via MITRE·07:34 PM

Data Sourced

via MITRE·07:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

No authentication is required. Exploitation is network-accessible, but it requires a user to interact with attacker-supplied content.

What is the potential impact if the vulnerability is exploited?

Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The CVSS vector also indicates scope may extend beyond the vulnerable plugin's security authority.

Which installations should be considered affected?