The vulnerability allows a user with contributor level access or higher in WordPress to inject scripted code into the 'note_before' and 'note_after' shortcode attributes. Because the plugin sanitizes input only with wp_kses_post for users lacking unfiltered_html capability, only certain kses‑allowed tags and attributes survive initial filtering. The sink that outputs these values is still unescaped, causing any remaining payload to execute in the victim’s browser when the shortcode is rendered, which is a classic stored cross‑site scripting flaw (CWE‑79).

WordPress Download Manager plugin (codename065) versions up to and including 3.3.61 are affected. It is inferred that subsequent releases, such as 3.3.62 and later, are not vulnerable, although this has not been independently confirmed.

The CVSS base score of 6.4 classifies the issue as moderate severity. The EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and possess contributor or higher permissions, after which they can inject script elements that persist through saving and trigger execution during page rendering.