{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39615", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:57:27.974Z", "datePublished": "2026-04-08T08:30:24.822Z", "dateUpdated": "2026-04-08T08:30:24.822Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "download-manager", "product": "Download Manager", "vendor": "Shahjada", "versions": [{"lessThanOrEqual": "3.3.53", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "hhhai | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:37.549Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.<p>This issue affects Download Manager: from n/a through <= 3.3.53.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:24.822Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53."}], "id": "CVE-2026-39615", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:31.323", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-51-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.53]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Download Manager", "source": "cna", "vendor": "Shahjada"}, "product": "download_manager", "vendor": "shahjada"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T09:41:45.603799+00:00", "value": {"mitigation_remediation": ["Upgrade Download Manager to version 3.3.54 or later, the first patch that eliminates the XSS flaw.", "Verify the upgrade by testing that the vulnerability no longer accepts and renders malicious input.", "If an upgrade cannot be performed immediately, disable or remove the problematic plugin from the site to stop the attack surface.", "Screen all existing content stored by the plugin for injected scripts and cleanse any dangerous entries.", "Monitor site logs for anomalous activity that could indicate exploitation attempts."], "summary": {"action": "Patch", "impact": "Cross\u2011site scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin \"Download Manager\" developed by Shahjada. Versions from the earliest release through 3.3.53 are vulnerable. Users must check whether their installation runs any of these versions; if so, they are at risk.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw that arises from improper neutralization of user input during web page generation. When an attacker supplies malicious script payloads through the Download Manager interface, these inputs are saved to the database and later rendered unfiltered in the front\u2011end. This enables the attacker to execute arbitrary JavaScript in the browsers of any user who views the affected pages, potentially leading to session hijacking, defacement, or phishing attempts. The weakness corresponds to CWE\u201179. The impact is confined to client\u2011side execution but can be leveraged for broader attacks if the user is authenticated or privileged. The vulnerability is explicitly described as \"Stored XSS\", indicating persistent exposure of injected code.", "risk_and_exploitability": "The CVSS score is not publicly provided, but the nature of a stored XSS suggests a moderate to high risk if the plugin is used in a publicly accessible site. Exploitability is straightforward: an attacker must craft input that the plugin accepts\u2014most likely through the admin interface or upload forms\u2014and later expose the data to unsuspecting visitors. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Nonetheless, the potential for client\u2011side compromise makes it worth addressing promptly."}}}}, "created": "2026-04-08T19:29:44.957154+00:00", "updated": "2026-04-08T19:42:01.659317+00:00", "vendors": ["shahjada", "shahjada$PRODUCT$download_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}