CVE-2026-86609: Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only the commercial Download Manager Pro edition is affected when it is earlier than 7.5.6. The free Download Manager plugin published under the same slug does not include the affected feature.
What does an attacker need to exploit this issue?
An attacker can submit crafted data through the email-locked download subscription form without authentication. The payload is stored and may execute when an administrator views the page that displays the submitted data.
What is the relevant exposure condition?
The vulnerable path is the email-locked download subscription form. Sites not using the Pro edition's affected feature are not described as exposed by the provided information.