The Download Manager WordPress plugin by codename065 contains a stored XSS vulnerability (CVE-2024-6208) due to improper neutralization of input in the 'cols' parameter of the 'wpdm_all_packages' shortcode. This allows authenticated users with contributor or higher privileges to inject malicious scripts that persist and execute in the context of other users viewing the injected pages. The vulnerability affects all plugin versions up to 3.2.97. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed. No patch or official remediation guidance is currently documented.

Successful exploitation allows an authenticated contributor or higher to inject and store malicious scripts that execute in the browsers of users who access the affected pages. This can lead to unauthorized actions performed in the context of the victim user, potentially compromising confidentiality and integrity of user data. There is no impact on availability. The vulnerability requires authenticated access with contributor-level privileges or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict contributor-level and higher access to trusted users only. Consider disabling or removing the Download Manager plugin if feasible. Monitor official codename065 channels for updates and apply any released patches promptly.