CVE-2026-5357: 
WordPress vulnerability analysis and mitigation

CVE-2026-5357 is a Stored Cross-Site Scripting (XSS) vulnerability in the Download Manager plugin for WordPress, affecting versions up to and including 3.3.52. The flaw exists in the wpdm_members shortcode's sid parameter, which is processed without proper sanitization or output escaping. It was published on April 9, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The sid parameter supplied to the wpdm_members shortcode is extracted without sanitization in the members() function (User.php, line 175) and persisted to the database via update_post_meta(). It is then echoed directly into an HTML id attribute within the members.php template (line 10) without applying WordPress's esc_attr() escaping function, allowing injected scripts to be stored and later rendered to any visitor of the affected page (GitHub Advisory, Wordfence).

Authenticated attackers with contributor-level access or higher can inject persistent malicious JavaScript into WordPress pages. When any user — including administrators — visits an affected page, the injected script executes in their browser context, enabling session cookie theft, credential harvesting, unauthorized actions on behalf of victims, website defacement, or redirection to malicious sites. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS scoring (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.036–0.046%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running Download Manager ≤ 3.3.52.
2. Create or edit a post: Navigate to the WordPress post editor and insert the [wpdm_members] shortcode with a crafted sid parameter containing a malicious XSS payload, e.g., [wpdm_members sid="malicious\" id=\"x\" onmouseover=\"alert(document.cookie)"].
3. Persist the payload: Submit or publish the post. The unsanitized sid value is stored in the database via update_post_meta() in User.php.
4. Trigger execution: When any user (including administrators) visits the page containing the shortcode, the members.php template echoes the stored value directly into an HTML id attribute without escaping, causing the injected script to execute in the visitor's browser.
5. Achieve objective: Leverage the executed script to steal session cookies, perform actions as the victim user, or escalate privileges by targeting an administrator session (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to post-editing endpoints (e.g., /wp-admin/post.php) from contributor-level accounts containing unusual characters (<, >, ", ', on*=) in shortcode parameters.
• Database: Unexpected or obfuscated JavaScript content stored in wp_postmeta table entries associated with the wpdm_members shortcode's sid meta key.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the [wpdm_members] shortcode, potentially indicating cookie exfiltration.
• File System: No direct file system artifacts expected for this stored XSS, but review for newly created or modified PHP files in the Download Manager plugin directory that could indicate further compromise following privilege escalation.

Update the Download Manager plugin to a version newer than 3.3.52, which contains the fix applying proper esc_attr() output escaping in members.php and input sanitization in User.php (GitHub Advisory, WordPress Changeset). As interim mitigations, restrict contributor-level role assignment to only fully trusted users, and deploy a Web Application Firewall (WAF) with XSS detection rules to block malicious shortcode payloads. Review all update_post_meta() calls and template rendering in the plugin to ensure consistent sanitization and escaping (Wordfence).

Wordfence, which assigned and disclosed the CVE, included it in their weekly WordPress vulnerability report for April 6–12, 2026 (Wordfence Blog). Sucuri also referenced the vulnerability in their April 2026 vulnerability patch roundup (Sucuri Blog). Community reaction has been limited given the medium severity and authentication requirement, with no notable researcher commentary or significant social media discussion beyond automated CVE tracking accounts.