---
id: "CVE-2026-119156"
page: "https://infrastack.ai/live/CVE-2026-119156"
kind: "vulnerability"
aliases: ["CVE-2026-119156"]
title: "WordPress Download Manager: registration form can set the admin's name to a script that runs on Spotlight-template pages"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "download-manager", "fixed": ["7.6.4", "3.3.75"], "affected": "<= 7.5.9 (Wordfence); 3.3.45 to 3.3.74 (WPSec, wordpress.org build)", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["download-manager", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "no-spotlight-template", "no-wpdm-reg-form", "registration-disabled"]
published_at: "2026-11-07T13:16:34+00:00"
first_seen_at: "2026-11-07T13:47:25+00:00"
updated_at: "2026-11-07T13:50:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119156", "first_seen_at": "2026-11-07T13:47:25+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name", "first_seen_at": "2026-11-07T13:50:44+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name", "https://wpsec.com/vuln/WPSEC-2026-2299/"]}]
exploit_sources: []
---

# WordPress Download Manager: registration form can set the admin's name to a script that runs on Spotlight-template pages

Link for people: https://infrastack.ai/live/CVE-2026-119156 (this .md is for agents)

A flaw in the Download Manager WordPress plugin's registration form lets an unauthenticated visitor store a script in the first administrator's name. WPSec describes it: a refused signup (e.g. username over 60 characters) updates user 1. The script then runs in visitors' browsers when a package by that admin is shown with the Spotlight template.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:download-manager affected <= 7.5.9 (Wordfence); 3.3.45 to 3.3.74 (WPSec, wordpress.org build) fixed 7.6.4, 3.3.75

## How to check

- Run `wp plugin get download-manager --field=version`: exposed if 7.5.9 or earlier, or 3.3.45 to 3.3.74 (free build per WPSec); fixed in 7.6.4 / 3.3.75.
- Look for a public page with the [wpdm_reg_form] shortcode.
- Check that 'Anyone can register' is on (Settings > General).
- Check that a package authored by user ID 1 is shown with the Spotlight link template. Also check whether the first administrator's display name looks altered.

## Fix

Update Download Manager to 7.6.4 or later (Wordfence). For the wordpress.org 3.3.x build, update to 3.3.75 or later (WPSec).

## Timeline

- 2026-11-07T13:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119156
- 2026-11-07T13:50:44+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name — Wordfence: affected <=7.5.9, patched 7.6.4. WPSec (same bug, WPSEC-2026-2299): wordpress.org build 3.3.45-3.3.74 fixed in 3.3.75 (2026-11-01). Version schemes differ (7.x likely Pro/other line); not confirmed on the vendor changelog, so nothing marked verified. No exploitation or PoC found.

## Documents

- [advisory] Wordfence: Download Manager <= 7.5.9 stored XSS via registration form https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/download-manager/download-manager-759-unauthenticated-stored-cross-site-scripting-via-registration-form-wp-error-as-id-via-spotlight-template-author-name
- [fix] WPSec: Download Manager 3.3.45-3.3.74 stored XSS via registration name fields https://wpsec.com/vuln/WPSEC-2026-2299/

## From the sources

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have "Anyone can register" enabled, the plugin's [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the Spotlight link template.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_