https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T12:24:33.682267+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-86609 CVE-2026-86609 — Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription 2026-09-28T12:24:33.683939+00:00

Affected: Unknown Download Manager

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.