CVE-2026-9696 in Download Manager Plugin
Summary
by MITRE • 10/10/2026
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within the Download Manager plugin for WordPress represents a significant security risk stemming from insufficient input sanitization and output escaping mechanisms. Specifically, this flaw is located in the not_found parameter, which handles custom error messages displayed when a requested download link cannot be found. In versions up to and including 3.3.58, the application fails to adequately validate or encode user-supplied data before storing it in the database and subsequently rendering it on web pages. This lack of proper handling allows malicious actors to inject arbitrary JavaScript code into these error messages, which are then served to other users visiting the site.
This specific type of vulnerability is classified as Stored Cross-Site Scripting, also known as Persistent XSS or Type 1 XSS under common industry standards such as CWE-80 and CWE-79. Unlike reflected XSS attacks where malicious scripts are executed immediately within a victim's browser via a crafted link, stored vulnerabilities persist on the target server. The injected script is saved in the application's database, meaning that every time an administrator or another user views the affected page containing the not_found message, the malicious code executes automatically. This persistence amplifies the potential impact significantly, as it does not require social engineering to trick a specific victim into clicking a link; rather, any visitor with access to the relevant pages becomes a potential target.
The operational prerequisites for exploiting this vulnerability include authenticated access to the WordPress site at Contributor-level or higher privileges. While lower-privileged users such as Subscribers may have limited capabilities, Contributors possess sufficient rights to create and edit posts or downloads where these error messages might be triggered or managed depending on plugin configuration. Once an attacker with these credentials injects the malicious payload via the not_found parameter, the consequences can range from session hijacking through cookie theft to complete account takeover if combined with other vulnerabilities. Furthermore, attackers may use this vector to deface websites, redirect users to phishing sites, or distribute malware by loading external scripts that perform additional exploits against client-side browsers.
From a tactical perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Client-Side Injection and potentially Credential Access via Browser Session Hijacking. The attacker leverages trusted web applications to execute code within the context of those sites, bypassing same-origin policy restrictions that typically protect users from malicious scripts originating on different domains. This trust relationship is abused because the browser treats the injected script as coming from a legitimate source, thereby granting it elevated permissions and access to sensitive data stored in cookies or local storage.
Mitigation strategies must focus primarily on immediate patching of the affected plugin version. Administrators should upgrade the Download Manager plugin to a version newer than 3.3.58 where these sanitization issues have been addressed by the developers. In addition to updating, implementing strict Content Security Policy headers can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts are allowed to load and execute. Input validation should be enforced at both the client and server sides, ensuring that only expected data types are accepted while dangerous characters such as angle brackets and quotes are properly encoded before storage. Output encoding must also be applied consistently whenever user-controllable data is rendered in HTML contexts to prevent script execution. Regular security audits and penetration testing can further identify similar weaknesses across other plugins or custom code within the WordPress environment, ensuring a more robust defense posture against persistent web-based attacks.