CVE-2026-39615

The Download Manager plugin for WordPress contains a security flaw in versions 3.3.53 and earlier, which allows malicious users with elevated permissions to embed unauthorized code into website content. This vulnerability arises from inadequate filtering of input data, enabling attackers to inject executable scripts that will run whenever affected pages are visited by other users.

Based on public CVE data (MITRE/NVD).