The WordPress Download Manager plugin, before version 3.3.66, fails to escape a package title before rendering it in front‑end templates. Users with the Author role or higher can store a title containing malicious JavaScript, which is then executed in the browsers of any visitor who views a page displaying the affected package, including unauthenticated users. This allows arbitrary script execution, leading to potential credential theft, session hijacking, defacement, or redirection of site visitors.

WordPress installations running the Download Manager plugin older than 3.3.66 are affected. The vulnerability affects any site that uses this plugin to display downloadable packages, regardless of the themes or other plugins present.

The EPSS score is under 1%, and the CVSS score of 5.4 indicates medium severity, reflecting a moderate exploitation risk, while the vulnerability is not listed in the CISA KEV catalog. However, the attack vector requires only that an author or higher-level user create a malicious title, a privilege commonly available. Once deployed, the stored XSS can affect all site visitors, making the risk high in terms of potential impact if an attacker succeeds.