The Download Manager plugin for WordPress contains a weakness where the value supplied to the 'icon' shortcode attribute is not properly sanitized or escaped when rendered. An authenticated contributor or higher can embed malicious JavaScript into any post or page that includes the shortcode, leading to arbitrary code execution inside the victim’s browser. The flaw is a classic input validation failure (CWE‑79).

WordPress sites running the Download Manager plugin on any version up to and including 3.3.66 are affected. The vulnerability applies when a contributor‑level or higher user inserts the ‘icon’ attribute in a shortcode within a page or post. All WordPress installations that use this plugin and have users with such roles are at risk.

The CVSS score of 6.4 places this issue in the medium severity range. The EPSS score of less than 1% indicates that, at the time of this analysis, exploitation probability is considered low, and it is not listed in the CISA KEV catalog. Nevertheless, once instantiated, the XSS payload runs in the context of any user who views the affected page. The likely attack vector is remote, via the WordPress administrative interface, requiring only contributor‑level access. An attacker can steal session cookies, deface pages, or redirect users to malicious sites.