CVE-2026-16685 is a stored cross-site scripting vulnerability in the codename065 Download Manager WordPress plugin affecting all versions up to and including 3.3.66. The vulnerability is due to improper neutralization of input in the 'icon' shortcode attribute, where input is not sufficiently sanitized or escaped before rendering. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript payloads that execute in the context of users viewing the injected pages. The WordPress function wp_kses_post() fails to prevent exploitation because it sanitizes post content at save time but does not handle shortcode attribute values at render time, leaving the injection vector open.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial confidentiality and integrity loss (e.g., theft of cookies or session tokens, unauthorized actions performed on behalf of users). Availability is not impacted. The vulnerability requires authenticated access with contributor or higher privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Download Manager plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once released.