The Download Manager WordPress plugin (codename065) suffers from a stored XSS vulnerability (CWE-79) in the 'wpdm_modal_login_form' shortcode. This flaw arises from improper neutralization of input during web page generation, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to 3.2.93. No official patch or fix information is provided in the available data.

An authenticated attacker with contributor-level access or above can inject persistent malicious scripts into pages using the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The impact is limited to confidentiality and integrity (partial), with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'wpdm_modal_login_form' shortcode if feasible to reduce exposure.