The Download Manager WordPress plugin versions prior to 3.3.71 have a stored XSS vulnerability (CWE-79) due to insufficient sanitization and escaping of a package setting before output. Users with Author role or above can exploit this by injecting malicious scripts that execute in the context of any visitor opening the download dialogue. This vulnerability only affects sites running PHP versions below 8.1 because the sanitization applied during setting save does not neutralize single quotes in those PHP versions. The CVSS 3.1 base score is 6.4, indicating a medium severity issue with network attack vector, high privileges required, user interaction needed, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Author or higher privileges to perform stored XSS attacks against any visitor who opens the affected package's download dialogue. This can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising user accounts, stealing sensitive information, or performing actions on behalf of the victim. The vulnerability impacts confidentiality, integrity, and availability as per the CVSS vector.

Upgrade the Download Manager plugin to version 3.3.71 or later, where this vulnerability is fixed. Sites running PHP 8.1 or later are not affected due to improved sanitization. No other mitigations are specified. Patch status is confirmed by the version boundary provided; users should apply the official update promptly.