CVE-2024-1766 is a stored cross-site scripting vulnerability (CWE-79) in the codename065 Download Manager WordPress plugin. It arises from insufficient input sanitization and output escaping of the user's Display Name field, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute when other users access the injected pages, requiring user interaction and login to trigger. The vulnerability affects all versions up to and including 3.2.86. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed, with limited confidentiality and integrity impact and no availability impact.

An attacker with subscriber-level access can inject malicious scripts via the Display Name field that execute in the context of other users who view the affected pages after logging in. The impact is limited by the need for social engineering to have victims log in and access the injected content. The vulnerability could lead to limited confidentiality and integrity compromise but does not affect availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and educate users to be cautious of social engineering attempts. Monitor for plugin updates from codename065 addressing this issue.