The Download Manager WordPress plugin (codename065) contains a stored XSS vulnerability (CWE-80) in the wpdm_user_dashboard shortcode due to improper neutralization of script-related HTML tags. Authenticated attackers with author-level privileges can inject malicious scripts that execute in the context of other users visiting the injected page. This vulnerability affects all plugin versions up to 3.3.18. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the level of an author, no user interaction needed, and a scope change with low confidentiality and integrity impact but no availability impact. No patch or vendor advisory is provided, so patch status is unknown.

Successful exploitation allows an authenticated user with author-level access or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure or integrity issues within the affected WordPress site. There is no known impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and consider disabling or limiting use of the wpdm_user_dashboard shortcode. Monitor for updates from codename065 regarding an official fix.