The Lana Downloads Manager plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, endpoint parameters do not undergo adequate sanitization or escaping, allowing authenticated administrators to inject malicious scripts that persist and execute in the context of users viewing the injected pages. This vulnerability affects versions up to and including 1.10.0. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impacts.

Successful exploitation allows an attacker with administrator-level privileges to inject persistent malicious scripts into pages served by the plugin. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress environment. There is no impact on availability reported. No known exploits are currently in the wild.

No official patch or remediation has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Lana Downloads Manager plugin if feasible to reduce risk.