CVE-2026-13733 is a stored cross-site scripting vulnerability in the codename065 Download Manager WordPress plugin. The issue exists in the handling of the 'no_data_msg' shortcode attribute, where insufficient input sanitization and output escaping allow authenticated contributors or higher to inject arbitrary web scripts. The WordPress function wp_kses_post, which normally strips HTML tokens from post content, does not neutralize C-style escape sequences embedded in shortcode attributes. As a result, malicious payloads survive filtering and are reconstructed into raw script tags at render time, leading to script execution in users' browsers. This vulnerability affects all versions up to and including 3.3.60.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages using the vulnerable shortcode attribute. These scripts execute in the context of users viewing the affected pages, potentially leading to theft of session tokens, user impersonation, or other client-side attacks. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity with low attack complexity, requiring privileges, and no user interaction needed. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode attribute if possible. Monitor vendor channels for updates and apply patches promptly once released.