CVE-2026-97338: Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdmeditprofile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. Exploitation also requires a front-end page containing the [wpdm_edit_profile] shortcode that is accessible to Subscriber-level users.
What must an attacker do to trigger the vulnerability?
The attacker submits a multiply entity-encoded script payload through the profile display name field. The payload is stored and executes when a user visits a page where the injected content is rendered.
Are sites using the plugin affected by default?
The issue is not exploitable solely from having the plugin installed. A qualifying front-end profile page using [wpdm_edit_profile] must be accessible to Subscriber-level users.
How can administrators reduce exposure before updating?
Remove or restrict Subscriber access to front-end pages containing the [wpdm_edit_profile] shortcode. Review display names submitted by lower-privileged accounts for suspicious encoded content.