CVE-2026-16685: WordPress Download Manager XSS Flaw

CVE-2026-16685 Overview

CVE-2026-16685 is a stored Cross-Site Scripting (XSS) vulnerability in the Download Manager plugin for WordPress. The flaw affects all versions up to and including 3.3.66. It exists because the plugin fails to sanitize input and escape output for the icon attribute of its shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes whenever a user views the affected page. The vulnerability is tracked as CWE-79.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in every visitor's browser, enabling session theft, administrative account takeover, and site defacement.

Affected Products

WordPress Download Manager plugin versions up to and including 3.3.66
WordPress sites allowing contributor-level or higher user registration
WordPress installations rendering the Download Manager category shortcode

Discovery Timeline

2026-08-01 - CVE-2026-16685 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16685

Vulnerability Analysis

The vulnerability resides in the Download Manager plugin's shortcode rendering pipeline. The plugin registers a category shortcode handled in src/Category/Shortcodes.php and rendered via src/Package/views/category-shortcode-toolbar.php. The icon shortcode attribute is emitted directly into HTML output at render time without escaping. An attacker with contributor privileges saves a post containing the shortcode with a malicious icon value. When any visitor loads that page, the browser executes the attacker-controlled JavaScript in the site's origin.

The attacker payload persists in the database and executes in the context of every viewer's session. Because the vulnerability produces a scope change (CVSS scope: Changed), impact extends beyond the vulnerable component to affect any authenticated user who visits an injected page, including administrators.

Root Cause

The root cause is a mismatch between the sanitization layer and the render layer. WordPress calls wp_kses_post() on post content at save time to strip disallowed HTML. However, wp_kses_post() does not parse or validate shortcode attribute values. When the shortcode later executes, the plugin reads the icon attribute and echoes it into the HTML output without calling esc_attr(), esc_html(), or an equivalent escaping function. Attribute values that appeared inert as raw text become active script when the shortcode is expanded into rendered markup.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker creates or edits a post containing the Download Manager category shortcode and supplies a crafted icon attribute value carrying HTML or JavaScript. After the post is published or previewed, any visitor who loads the page triggers the injected script. Because contributor accounts are widely available on multi-author sites and open-registration blogs, the barrier to abuse is low. Attackers commonly chain stored XSS with administrator session theft to escalate to full site compromise.

The vulnerability mechanism is documented in the referenced Download Manager source files: Shortcodes.php L18, category-shortcode-toolbar.php L17, category-shortcode-toolbar.php L36, and UI.php L81.

Detection Methods for CVE-2026-16685

Indicators of Compromise

Posts or pages containing Download Manager shortcodes with icon attribute values that include <, >, ", ', javascript:, onerror=, or onload= sequences
Unexpected <script> tags or event handler attributes in rendered HTML output of pages using the plugin's category shortcode
New or recently promoted contributor accounts whose authored posts contain Download Manager shortcodes
Outbound requests from visitor browsers to unfamiliar domains shortly after loading pages that render Download Manager content

Detection Strategies

Query the WordPress wp_posts table for post_content containing the Download Manager shortcode combined with suspicious icon= attribute payloads
Deploy a Web Application Firewall (WAF) rule that inspects shortcode attribute values for HTML metacharacters and script keywords
Monitor Content Security Policy (CSP) violation reports for inline-script or event-handler violations on pages served by the plugin

Monitoring Recommendations

Audit contributor and author role assignments on a recurring schedule and remove unused accounts
Enable file integrity monitoring for the wp-content/plugins/download-manager/ directory to detect tampering
Forward WordPress access, authentication, and post-revision logs to a centralized SIEM or data lake for correlation with visitor telemetry

How to Mitigate CVE-2026-16685

Immediate Actions Required

Update the Download Manager plugin to the patched version released after 3.3.66 as soon as it is available from the WordPress plugin repository
Review all posts and pages containing Download Manager shortcodes and remove or sanitize any suspicious icon attribute values
Restrict contributor and author role assignments to trusted users only, and disable open user registration if not required
Rotate administrator session cookies and force password resets if injection is confirmed

Patch Information

The vendor's fix is tracked in the WordPress Download Manager change set. Additional technical details are available in the Wordfence Vulnerability Report. Site operators running any version up to and including 3.3.66 must upgrade to the fixed release.

Workarounds

Temporarily deactivate the Download Manager plugin until the patched version is installed
Remove or downgrade contributor-level and author-level accounts that do not require posting privileges
Deploy a WAF rule to block requests where post content contains Download Manager shortcodes with HTML metacharacters in the icon attribute
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized event handlers on public-facing pages

bash

# Example WP-CLI commands to identify vulnerable content and mitigate
wp plugin get download-manager --field=version
wp post list --post_type=any --s='[wpdm_category' --format=csv
wp plugin deactivate download-manager