CVE-2026-86609

Summary

The flaw allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) attacks by injecting malicious scripts through the email-locked download subscription form, which could lead to data exfiltration, information disclosure, and potential administrative control.

Exploitability

Exploitation is relatively easy as it requires submitting a payload through the subscription form. Attackers must have access to the form and be able to submit data.

Blast radius

If exploited, the attack could impact all administrators who visit the affected admin page, potentially leading to widespread data compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Download Manager WordPress plugin version 7.5.6 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.