https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:23:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-5357 <p><strong>Affected:</strong> codename065 Download Manager</p> <p>The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;sid&#39; parameter of the &#39;wpdm_members&#39; shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied &#39;sid&#39; shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.</p> <p><strong>Affected:</strong> codename065 Download Manager</p> <p>The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;sid&#39; parameter of the &#39;wpdm_members&#39; shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied &#39;sid&#39; shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.</p> https://cve.radiocsirt.org/vuln/cve-2026-5357