CVE-2026-86610: Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use W3 Eden Download Manager earlier than 3.3.71 and run PHP below 8.1. The issue depends on the vulnerable package-setting sanitisation behavior on those PHP versions.
What access and user interaction are required for exploitation?
An attacker needs an account with the WordPress Author role or higher to set the malicious package icon value. The stored script runs when a visitor opens the affected package's download dialogue; that visitor may be an administrator.
How can I determine whether the issue may already be present?
Review package icon settings created or modified by Author-level or higher users, particularly on sites running PHP below 8.1. Affected stored content would execute when the corresponding package download dialogue is opened.