An improper neutralization of input web page generation in Shahjada's Download Manager plugin enables stored cross‑site scripting. This vulnerability means an attacker can inject malicious JavaScript that is later rendered in the browser of any user who views the affected content, potentially leading to session hijacking, defacement, or other malicious client‑side actions.

The flaw affects all instances of the Shahjada Download Manager WordPress plugin with versions up through 3.3.53. Any site that has installed this plugin or any of its predecessors may be vulnerable unless updated.

The CVSS score of 5.9 indicates a moderate risk, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the KEV catalog. Attackers would likely need access to the administrative interface or a content editing capability to inject the malicious payload, after which the stored XSS would affect all visitors to the impacted pages.