CVE-2026-97338

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.71

Description The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts through the display name field. This exploitation is possible when the [wpdm edit profile] shortcode is present on a front-end page accessible to these users, allowing them to bypass sanitization using a multiply entity-encoded payload. The injected scripts execute whenever a user visits the affected page.

Recommendations Update Download Manager to version 3.3.71 or later. As a temporary mitigation, remove the [wpdm edit profile] shortcode from all front-end pages accessible to Subscriber-level users.