The Download Manager plugin for WordPress suffers from a stored XSS vulnerability via the 'sid' parameter of the 'wpdm_members' shortcode in versions up to 3.3.52. The vulnerability is due to insufficient input sanitization and output escaping: the 'sid' parameter is extracted without sanitization in the members() function, stored via update_post_meta(), and then output directly into an HTML id attribute in the members.php template without using esc_attr(). This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary scripts that execute in the context of users viewing the affected page.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality and integrity of user sessions and data within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Download Manager plugin if possible. Monitor for updates from codename065 and apply any official patches promptly once available.