{"id":"CVE-2026-119156","kind":"vulnerability","aliases":["CVE-2026-119156"],"related":[],"title":"WordPress Download Manager: registration form can set the admin's name to a script that runs on Spotlight-template pages","description":"The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have \"Anyone can register\" enabled, the plugin's [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the Spotlight link template.","summary":"A flaw in the Download Manager WordPress plugin's registration form lets an unauthenticated visitor store a script in the first administrator's name. WPSec describes it: a refused signup (e.g. username over 60 characters) updates user 1. The script then runs in visitors' browsers when a package by that admin is shown with the Spotlight template.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"download-manager","fixed":["7.6.4","3.3.75"],"affected":"<= 7.5.9 (Wordfence); 3.3.45 to 3.3.74 (WPSec, wordpress.org build)","ecosystem":"wordpress"}],"ecosystems":[],"tags":["download-manager","package","self-hosted","wordpress"],"not_affected_if":["default-config","no-spotlight-template","no-wpdm-reg-form","registration-disabled"],"how_to_check":"- Run `wp plugin get download-manager --field=version`: exposed if 7.5.9 or earlier, or 3.3.45 to 3.3.74 (free build per WPSec); fixed in 7.6.4 / 3.3.75.\n- Look for a public page with the [wpdm_reg_form] shortcode.\n- Check that 'Anyone can register' is on (Settings > General).\n- Check that a package authored by user ID 1 is shown with the Spotlight link template. Also check whether the first administrator's display name looks altered.","fix":"Update Download Manager to 7.6.4 or later (Wordfence). For the wordpress.org 3.3.x build, update to 3.3.75 or later (WPSec).","status":"open","published_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:17+00:00","updated_at":"2026-11-07T13:50:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T13:49:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Download Manager: registration form lets visitors inject scripts","impact":"medium","summary":"The Download Manager plugin for WordPress does not sanitize first name, last name and username fields in its registration form, so unauthenticated visitors can store scripts that run in other users' browsers. An attacker can run script in the context of any visitor who opens an affected page, which can hijack sessions or act as the victim.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","download-manager","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Scripts run in visitors' browsers, enabling session theft and account actions","analyst_note":"Confirm the fixed version in the Wordfence or WordPress plugin repository changelog for Download Manager; the NVD entry gives only the affected range up to 7.5.9.","how_to_check":"- Check the installed plugin version: `wp plugin get download-manager --field=version` or the plugin list in the WordPress admin, and see whether it is `7.5.9` or earlier.\n- Look for a public page containing the `[wpdm_reg_form]` shortcode.\n- Confirm whether 'Anyone can register' is enabled under Settings > General.","plain_action":"","needs_analyst":true,"not_affected_if":["registration-disabled","no-wpdm-reg-form","default-config"],"who_is_affected":"Sites running the Download Manager WordPress plugin up to and including 7.5.9 that allow public registration and publish the [wpdm_reg_form] shortcode on a public page. The sources say exposure also needs at least one package authored by user ID 1 rendered with the Spotlight link template. Sites with registration closed, no public registration form, or a plugin version newer than 7.5.9 can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4356,"output_tokens":676,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version in the Wordfence or WordPress plugin repository changelog for Download Manager; the NVD entry gives only the affected range up to 7.5.9.","search":"'-119156':24A,27A '-2026':23A,26A '1':76B,196C '60':72B '7.5.9':132C 'access':161C 'admin':9A,89B 'administr':60B 'anyon':171C 'arbitrari':150C 'attack':147C 'author':192C 'browser':83B 'charact':73B 'cross':107C 'cross-sit':106C 'cve':22A,25A 'describ':64B 'download':2A,29A,32B,43B,97C 'download-manag':31B 'download-manager':28A 'due':133C 'e.g':69B 'enabl':174C 'escap':140C 'execut':157C 'first':59B,114C 'flaw':40B 'form':5A,49B,180C 'host':37B 'id':195C 'includ':131C 'inject':149C,163C 'input':136C 'insuffici':135C 'last':118C 'least':189C 'let':50B 'link':201C 'login':123C 'make':142C 'manag':3A,33B,44B,98C 'manager':30A 'name':11A,62B,115C,119C 'one':190C 'output':139C 'packag':34B,86B,191C 'page':21A,154C,164C,186C 'paramet':124C 'plugin':46B,99C,176C 'possibl':144C 'public':185C 'publish':182C 'refus':67B 'reg':113C,117C,121C,179C 'regist':173C 'registr':4A,48B 'render':197C 'requir':166C 'run':16A,80B 'sanit':137C 'script':14A,56B,78B,109C,152C 'self':36B 'self-host':35B 'set':7A 'shortcod':181C 'shown':91B 'signup':68B 'site':108C,168C 'spotlight':19A,94B,200C 'spotlight-templ':18A 'store':54B,105C 'templat':20A,95B,202C 'unauthent':52B,146C 'updat':74B 'user':75B,122C,160C,194C 'usernam':70B 'version':127C 'via':110C 'visitor':53B,82B 'vulner':103C 'web':151C 'whenev':158C 'wordpress':1A,38B,45B,101C 'wpdm':112C,116C,120C,178C 'wpsec':63B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Download Manager WordPress plugin up to and including 7.5.9 that allow public registration and publish the [wpdm_reg_form] shortcode on a public page. The sources say exposure also needs at least one package authored by user ID 1 rendered with the Spotlight link template. Sites with registration closed, no public registration form, or a plugin version newer than 7.5.9 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["downloadmanager"],"ptokens":["download","manager"],"labels":["downloadmanager","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119156':24A,27A '-2026':23A,26A 'admin':9A 'cve':22A,25A 'download':2A,29A 'download-manager':28A 'form':5A 'manag':3A 'manager':30A 'name':11A 'page':21A 'registr':4A 'run':16A 'script':14A 'set':7A 'spotlight':19A 'spotlight-templ':18A 'templat':20A 'wordpress':1A","search_b":"'1':76B '60':72B 'admin':89B 'administr':60B 'browser':83B 'charact':73B 'describ':64B 'download':32B,43B 'download-manag':31B 'e.g':69B 'first':59B 'flaw':40B 'form':49B 'host':37B 'let':50B 'manag':33B,44B 'name':62B 'packag':34B,86B 'plugin':46B 'refus':67B 'registr':48B 'run':80B 'script':56B,78B 'self':36B 'self-host':35B 'shown':91B 'signup':68B 'spotlight':94B 'store':54B 'templat':95B 'unauthent':52B 'updat':74B 'user':75B 'usernam':70B 'visitor':53B,82B 'wordpress':38B,45B 'wpsec':63B","search_c":"'1':196C '7.5.9':132C 'access':161C 'anyon':171C 'arbitrari':150C 'attack':147C 'author':192C 'cross':107C 'cross-sit':106C 'download':97C 'due':133C 'enabl':174C 'escap':140C 'execut':157C 'first':114C 'form':180C 'id':195C 'includ':131C 'inject':149C,163C 'input':136C 'insuffici':135C 'last':118C 'least':189C 'link':201C 'login':123C 'make':142C 'manag':98C 'name':115C,119C 'one':190C 'output':139C 'packag':191C 'page':154C,164C,186C 'paramet':124C 'plugin':99C,176C 'possibl':144C 'public':185C 'publish':182C 'reg':113C,117C,121C,179C 'regist':173C 'render':197C 'requir':166C 'sanit':137C 'script':109C,152C 'shortcod':181C 'site':108C,168C 'spotlight':200C 'store':105C 'templat':202C 'unauthent':146C 'user':122C,160C,194C 'version':127C 'via':110C 'vulner':103C 'web':151C 'whenev':158C 'wordpress':101C 'wpdm':112C,116C,120C,178C","first_public_at":"2026-11-07T13:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119156","severity":null,"published_at":"2026-11-07T13:16:34+00:00","modified_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119156:2126","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name","severity":null,"published_at":"2026-11-07T13:50:44+00:00","modified_at":"2026-11-07T13:50:44+00:00","first_seen_at":"2026-11-07T13:50:44+00:00","fetched_at":"2026-11-07T13:50:44+00:00","note":"Wordfence: affected <=7.5.9, patched 7.6.4. WPSec (same bug, WPSEC-2026-2299): wordpress.org build 3.3.45-3.3.74 fixed in 3.3.75 (2026-11-01). Version schemes differ (7.x likely Pro/other line); not confirmed on the vendor changelog, so nothing marked verified. No exploitation or PoC found.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name","https://wpsec.com/vuln/WPSEC-2026-2299/"]}],"documents":[{"id":95878,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name","title":"Wordfence: Download Manager <= 7.5.9 stored XSS via registration form","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95879,"url":"https://wpsec.com/vuln/WPSEC-2026-2299/","title":"WPSec: Download Manager 3.3.45-3.3.74 stored XSS via registration name fields","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}