The Download Manager plugin for WordPress permits authenticated users with subscriber-level access or higher to inject arbitrary scripts into pages that display the user’s display name. The plugin lacks sufficient input sanitization and output escaping for the display name field, allowing a multiply entity‑encoded payload to bypass filters and be stored. When a page containing the [wpdm_edit_profile] shortcode is accessed, the malicious script executes in the visitor’s browser, enabling arbitrary client‑side code execution and potential defacement or session hijacking.

The affected product is the Download Manager WordPress plugin, identified as codename065:Download Manager. All published releases up to and including version 3.3.70 contain the flaw. Users should verify their installed version and plan an upgrade accordingly.

The CVSS score of 6.4 indicates a moderate impact, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated subscriber or higher user and a frontend page containing the [wpdm_edit_profile] shortcode that subscribers can access. Once the payload is submitted via the display name field, it is stored and executed for any visitor loading that page, making the attack feasible in a typical site configuration.