The Download Manager WordPress plugin versions prior to 3.3.66 fail to properly sanitize or escape the package title field before outputting it in front-end templates. This improper output encoding leads to a stored XSS vulnerability (CWE-79), where an attacker with Author or higher privileges can craft a package title containing malicious JavaScript. When any user, including unauthenticated visitors, views the page displaying this package, the injected script executes in their browser context.

Successful exploitation allows an attacker with Author-level access to execute arbitrary JavaScript in the browsers of any users who view the affected package page. This can lead to session hijacking, defacement, or other client-side attacks against visitors, including unauthenticated users. The vulnerability arises from insufficient output escaping of user-controlled input in the front-end display.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role users from creating or editing package titles or remove the plugin if possible. Monitor vendor channels for updates providing an official fix or temporary mitigation.