CVE-2026-5357: Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdmmembers' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via updatepostmeta(), then echoed directly into an HTML id attribute in the members.php template without applying escattr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Download Manager pluginto a version that resolves this vulnerability.Fixed in 3.3.52 - Configuration
Modify the wpdm_members shortcode handling so the user-supplied 'sid' attribute is properly sanitized before update_post_meta() and escaped with esc_attr() when echoed into the HTML id attribute in members.php (members() function flow currently lacks escaping).
WordPress Download Manager plugin (wpdm_members shortcode/templates) sid parameter output escaping = Use esc_attr() for the sid value before rendering into the HTML id attribute (members.php template)
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have at least Contributor-level access to WordPress. No user interaction is required from the attacker after placing the malicious shortcode content.
How can I identify content that may be affected?
Review pages containing the wpdm_members shortcode and inspect their sid attribute values. The vulnerable value is stored as post metadata and is later rendered into an HTML id attribute.