The vulnerability lies in the Download Manager Pro WordPress plugin before version 7.5.6. Data entered through the email‑locked download subscription form is stored by the plugin and later output on an admin‑page without proper sanitisation or escaping. This flaw allows an attacker to inject arbitrary JavaScript that will execute in the browser context of any WordPress administrator who views the affected admin page.

Affects the commercial Download Manager Pro WordPress plugin with any release earlier than 7.5.6. The free (non‑Pro) Download Manager plugin, though released under the same slug, does not include the vulnerable subscription feature and is therefore not impacted.

Exploitability is high because the attack requires no authentication; any person with internet access can submit a malicious payload via the public subscription form. The CVSS score of 8.8 indicates high severity, while the EPSS score is < 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits at the time of assessment. An attacker could execute scripts when an administrator visits the affected admin page, potentially allowing arbitrary JavaScript execution in the administrator’s browser context.