The vulnerability comes from the way the plugin handles a parameter in a short‑code that is meant to be an identifier. The parameter value is stored without any filtering and is later directly inserted into the page’s markup. A user who can write or edit the short‑code with at least contributor rights can therefore place malicious script code into the parameter and have that script executed whenever any visitor loads a page that renders the short‑code.

All WordPress instances that use the Download Manager plugin maintained by codename065 and run a version up to and including 3.3.52 are affected. The flaw exists purely within the plugin, independent of the core WordPress platform, so any site running an vulnerable plugin version is at risk.

The base score suggests a moderate risk level. Exploitation requires authenticated access with contributor or higher privileges to edit the short‑code. No public exploit is available, and the issue is not listed in CISA’s catalog of known exploited vulnerabilities. Once the malicious code is inserted, it will run for every visitor to pages that include the short‑code, potentially enabling data theft, site defacement or further compromise. The overall threat is moderate but should be remediated promptly.