CVE-2026-13733

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.61

Description Insufficient input sanitization and output escaping in the Download Manager plugin for WordPress allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. By using the no data msg shortcode attribute, an attacker can inject arbitrary web scripts into pages. While the wp kses post function is used to filter post content, it fails to neutralize C-style escape sequences within shortcode attributes, allowing a payload to bypass the filter and execute as a raw script tag when the page is rendered.

Recommendations Update the plugin to a version newer than 3.3.60.