CVE-2026-119156

The Download Manager plugin for WordPress (versions

CVE-2026-119156 Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-119213

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmregfirstname, wpdmreglastname, wpdmreguserlogin' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...