CVE-2026-86609— Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
Quick assessment
Affected
Unknown Download Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
7.5.6 版本之前的 Download Manager WordPress 插件未对其电子邮件锁定的下载订阅表单中提交的数据进行 sanitization 和 escape 处理，当这些数据在后台管理页面中重新输出时，可能使未经身份验证的攻击者对管理员执行存储型跨站脚本（Stored XSS）攻击。此漏洞仅影响商业版 Pro 版本；使用相同插件句柄（slug）发布、7.5.6 之前的免费版 Download Manager WordPress 插件不包含受影响的功能。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86609
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
Source: CVE Program / CVE List V5
Vulnerability Description
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Download Manager | 4.0.0 ~ 7.5.6 | - |
|
II. Public POCs for CVE-2026-86609
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86609
请登录查看更多情报信息。
Other References for CVE-2026-86609 (1)
-
https://wpscan.com/vulnerability/85ebf2d8-af69-434c-b733-8156210d6d6a/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-27 · 19 CVEs total
| CVE-2026-89006 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import | |
| CVE-2026-84069 | WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php | |
| CVE-2026-81655 | Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields | |
| CVE-2026-82841 | UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migrati | |
| CVE-2026-85002 | EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes | |
| CVE-2026-86839 | Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via I | |
| CVE-2026-86841 | Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced O | |
| CVE-2026-89001 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing vi | |
| CVE-2026-89003 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview | |
| CVE-2026-96899 | Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script | |
| CVE-2026-89000 | WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run | |
| CVE-2026-96896 | Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deleti | |
| CVE-2026-96897 | Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Passw | |
| CVE-2026-96895 | WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes | |
| CVE-2026-92995 | Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file | |
| CVE-2026-92436 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via I | |
| CVE-2026-97319 | PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block | |
| CVE-2026-97227 | NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential |
IV. Related Vulnerabilities
Same product: Download Manager
-
CVE-2026-92714
Download Manager <= 3.3.68 - Insecure Direct Object Referenc -
CVE-2026-16685
Download Manager <= 3.3.66 - Authenticated (Contributor+) St -
CVE-2026-14292
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via -
CVE-2026-14235
WordPress Download Manager < 3.3.62 - Unauthorized Protected -
CVE-2026-14343
Download Manager <= 3.3.61 - Authenticated (Contributor+) St
Same vendor: Unknown
-
CVE-2026-92996
Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via -
CVE-2026-89411
Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbo -
CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking P -
CVE-2026-88828
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked Us -
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Sho
V. Comments for CVE-2026-86609
No comments yet