CVE-2026-97338 in Download Manager Plugin
Summary
by MITRE • 10/02/2026
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The WordPress Download Manager plugin contains a critical security vulnerability affecting all versions up to and including 3.3.70. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, specifically identified under CWE-89 for improper neutralization of special elements in database queries or similar contexts where input sanitization fails. The root cause lies in insufficient input validation and the absence of proper output escaping when handling user-supplied data within the plugin's profile management functionality. This architectural weakness allows malicious actors to inject executable JavaScript code into stored fields, which are then rendered by web browsers without adequate filtering mechanisms.
The vulnerability specifically targets the Display Name field associated with user profiles managed through the Download Manager system. For an attacker to exploit this flaw, they must possess authenticated access at least at the subscriber level or higher within the WordPress environment. This requirement significantly lowers the barrier for exploitation compared to unauthenticated attacks but remains a serious risk in multi-user sites where lower-privilege accounts are common. The attack vector is facilitated by the presence of the [wpdm_edit_profile] shortcode on any front-end page that is accessible to users with subscriber-level permissions. When such a user accesses this specific profile editing interface, they can submit form data containing malicious payloads directly into their display name attribute.
The technical execution involves submitting multiply entity-encoded JavaScript strings through the display name input field. The plugin fails to adequately sanitize these inputs before storing them in the database and subsequently fails to escape them properly when rendering the user's profile information on subsequent page loads. As a result, when another user or administrator views the compromised profile, the browser interprets the stored script as executable code rather than plain text. This leads to the execution of arbitrary web scripts within the context of the victim’s session, effectively bypassing same-origin policy protections and allowing the attacker to perform actions on behalf of the affected user.
The operational impact of this vulnerability is severe due to its persistent nature. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, stored XSS persists in the database and affects every visitor who views the compromised profile page. Attackers can leverage this capability to steal session cookies, hijack administrative sessions if an admin visits the infected page, deface websites by altering displayed content, or redirect users to phishing sites designed to harvest credentials. The ability to execute scripts across multiple user interactions amplifies the potential damage and complicates incident response efforts since the malicious code remains active until manually removed from the database.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. Administrators should immediately update the Download Manager plugin to version 3.3.71 or later, where these sanitization and escaping issues have been resolved by the developers. In cases where updating is not immediately feasible, implementing a Web Application Firewall can help filter out malicious payloads attempting to exploit this specific input field. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources can mitigate the impact of successful XSS attacks by preventing unauthorized scripts from running in user browsers.
From an industry standards perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007 for Command and Scripting Interpretation via JavaScript within web applications. It also reflects common failures described in OWASP Top 10 under Injection flaws, particularly those related to insufficient validation of user input before storage or display. Security teams should prioritize patch management processes that ensure plugins are kept up-to-date with the latest security fixes provided by vendors. Regular audits of plugin code for proper use of WordPress sanitization functions like sanitize_text_field and escaping functions like esc_html can prevent similar vulnerabilities in custom developments or other third-party extensions.