CVE-2026-86609

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin (Pro edition) versions prior to 7.5.6

Description The Pro edition of the plugin fails to sanitize and escape data submitted via the email-locked download subscription form before displaying it on an administrative page. This allows unauthenticated attackers to execute Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server and executed in the browser of an administrator.

Recommendations Update Download Manager WordPress plugin (Pro edition) to version 7.5.6 or later.