The Download Manager plugin for WordPress contains a stored cross‑site scripting flaw that allows authenticated users with author privileges or higher to inject arbitrary JavaScript through the wpdm_user_dashboard shortcode. The injected script is permanently recorded in the site database and runs whenever a viewer opens an affected page, enabling content tampering, credential theft, or malicious payload delivery. This CW80 weakness compromises confidentiality, integrity, and availability for site visitors and administrators.

The vulnerability affects the Download Manager plugin for WordPress (codename065:Download Manager), all releases up to and including version 3.3.18. WordPress users running any of those versions on any WordPress installation, regardless of hosting environment, are potentially exposed.

This is a moderate severity flaw with a CVSS score of 6.4. The EPSS score indicates a very low probability of exploitation (<1%) and it is not listed in CISA's KEV catalog. Exploitation requires the attacker to have authenticated author‑level access or higher; the attacker must then supply a malicious value for the wpdm_user_dashboard shortcode when creating or editing a dashboard. If successful, the injected script will execute automatically for any site visitor, turning it into an XSS attack vector.