CVE-2026-5357: WordPress Download Manager XSS Vulnerability

CVE-2026-5357 Overview

CVE-2026-5357 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Download Manager plugin for WordPress in all versions up to and including 3.3.52. The flaw resides in the wpdm_members shortcode, where the sid attribute is processed without sanitization or output escaping. Authenticated users holding contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when the affected page is loaded. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Contributor-level attackers can persist malicious scripts on WordPress pages, enabling session theft, redirection, and administrative account takeover when privileged users visit the affected content.

Affected Products

• WordPress Download Manager plugin versions up to and including 3.3.52
• WordPress sites permitting contributor-level or higher user registration
• Any WordPress installation rendering the wpdm_members shortcode

Discovery Timeline

• 2026-04-09 - CVE-2026-5357 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-5357

Vulnerability Analysis

The vulnerability stems from unsafe handling of a user-controlled shortcode attribute inside the Download Manager plugin. When a page or post containing the wpdm_members shortcode is rendered, the plugin's members() function extracts the sid attribute directly from the shortcode parameters. The value is never passed through sanitize_text_field(), wp_kses(), or any equivalent filter before being persisted using update_post_meta(). The stored value is then echoed into the members.php template inside an HTML id attribute without esc_attr() applied. This sequence creates a stored XSS sink that is rendered for every visitor of the affected page.

Root Cause

The root cause is missing input sanitization at ingest and missing output escaping at render. Contributor-level WordPress accounts can insert shortcodes into draft content. Because the sid attribute travels from shortcode input to database to HTML attribute context with no encoding, an attacker can break out of the id attribute using a double quote and inject an event handler or <script> element. The vulnerability is classified as [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires authenticated access at the contributor role or above. An attacker authors a post containing a wpdm_members shortcode where the sid parameter carries an attribute-breaking payload. Once the draft is submitted and an editor or administrator previews or publishes the content, the payload is stored via update_post_meta() and rendered into the page's HTML. Any subsequent visitor, including administrators, executes the injected script in the context of the site's origin. No verified public proof-of-concept code is available for this issue; see the Wordfence Vulnerability Report and the WordPress members.php Source Code for the affected sink.

Detection Methods for CVE-2026-5357

Indicators of Compromise

• Post or page meta entries created by contributor accounts containing wpdm_members shortcodes with unusual sid values containing quotes, angle brackets, or on* event handler strings.
• Outbound requests from visitor browsers to unfamiliar domains shortly after loading pages that include the wpdm_members shortcode.
• New or modified administrator accounts following contributor activity on pages embedding the vulnerable shortcode.

Detection Strategies

• Search the wp_postmeta table for stored sid values that include characters such as ", <, >, or substrings like javascript:, onerror=, or onload=.
• Audit posts authored by contributor and author roles that contain the [wpdm_members ...] shortcode and review the attribute values rendered in production pages.
• Inspect rendered HTML of affected pages for id attributes containing characters or markup that should not be present in an HTML identifier.

Monitoring Recommendations

• Enable WordPress audit logging for shortcode-bearing posts and for post meta changes performed by non-administrator roles.
• Deploy a Web Application Firewall (WAF) rule that inspects shortcode parameters for HTML and JavaScript injection patterns on POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php.
• Alert on Content Security Policy (CSP) violations from authenticated administrative sessions, which can indicate that a stored payload executed against a privileged user.

How to Mitigate CVE-2026-5357

Immediate Actions Required

• Update the WordPress Download Manager plugin to a version newer than 3.3.52 that incorporates the upstream fix referenced in the WordPress Changeset Overview.
• Review all existing posts and pages containing the wpdm_members shortcode and remove any sid attribute values that contain HTML or JavaScript syntax.
• Audit contributor and author accounts and revoke access for any unrecognized or untrusted users.

Patch Information

The vendor addressed the issue in the version following 3.3.52. The fix adds proper sanitization of the sid shortcode attribute before storage and applies esc_attr() when rendering the value into the id HTML attribute in members.php. Refer to the WordPress members.php Source Code and WordPress User.php Source Code for the corrected implementation.

Workarounds

• Restrict contributor and author roles from publishing content containing the wpdm_members shortcode by removing shortcode privileges via a custom capability filter.
• Disable the Download Manager plugin until the patched release can be deployed across the environment.
• Apply a Content Security Policy (CSP) that disallows inline script execution to limit the impact of stored XSS payloads on rendered pages.

# Configuration example: identify vulnerable shortcode usage via WP-CLI
wp post list --post_status=any --format=ids \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -nE '\[wpdm_members[^]]*sid="[^"]*[<>"][^"]*"'