CVE-2026-102401: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in codename065 Download Manager

CVE-2026-102401 is a stored cross-site scripting vulnerability in the Download Manager WordPress plugin by codename065. The flaw exists in the handling of the 'regurl' parameter, where input is not properly sanitized or escaped before being output in the login-form.php template. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes when logged-out users access the injected page. The vulnerability affects all versions from 0 up to and including 3.3.71. The vulnerability does not affect logged-in users because the vulnerable template branch is gated by a check for non-logged-in users (!is_user_logged_in()).

An attacker with contributor-level or higher access can inject persistent malicious scripts that execute in the browsers of logged-out visitors to the affected pages. This can lead to theft of cookies, session tokens, or other sensitive information accessible to the victim's browser. The vulnerability does not impact availability or integrity of the system directly but compromises confidentiality for unauthenticated users viewing the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'regurl' parameter. Monitor for updates from codename065 regarding an official patch or workaround.