CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.

• CWE-79

• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L232
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L979
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/User/EditProfile.php#L57
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L224
• https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L300
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3715131%40download-manager&new=3715131%40download-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e04b75d4-9bf5-4b26-ac3a-88a10d200c50?source=cve

Published

Oct 2, 2026

Last Modified

Oct 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97332The User Private Files WordPress plugin before 2.2.0 does n…5.3
• CVE-2026-97333QAPI contained a stack-based buffer overflow affecting servi…7.1
• CVE-2026-97334The network messaging layer contained improper handling of h…8.7
• CVE-2026-97335Incorrect authorization in the custom storage volume creatio…7.7
• CVE-2026-97336The CMB2 plugin for WordPress is vulnerable to Stored Cross-…7.2
• CVE-2026-97337The Simple Membership plugin for WordPress is vulnerable to …7.5
• CVE-2026-97339The Complianz GDPR/CCPA Cookie Consent Banner plugin for Wor…7.2
• CVE-2026-9734The W3SC Elementor to Zoho CRM plugin for WordPress is vulne…4.3
• CVE-2026-97340The Avada | Website Builder For WordPress & WooCommerce them…6.4
• CVE-2026-97341The Visitor Traffic Real Time Statistics plugin for WordPres…7.2
• CVE-2026-97342The JetFormBuilder — Dynamic Blocks Form Builder plugin for …7.2
• CVE-2026-97343The Burst Statistics – Simple WordPress Analytics (Google An…4.3