CVE-2026-97338 is a stored cross-site scripting vulnerability in the codename065 Download Manager WordPress plugin affecting versions up to 3.3.70. The flaw allows authenticated users with subscriber-level privileges or above to inject multiply entity-encoded payloads into the display name field, bypassing sanitization controls. This malicious script executes whenever any user accesses a page containing the injected content, provided the [wpdm_edit_profile] shortcode is used on a front-end page accessible to subscribers. The vulnerability is due to improper neutralization of input during web page generation (CWE-79).

Successful exploitation allows an authenticated low-privilege user to execute arbitrary scripts in the context of other users' browsers, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict subscriber-level users' ability to access or submit the [wpdm_edit_profile] shortcode on front-end pages or remove the shortcode from publicly accessible pages. Additionally, consider limiting subscriber privileges or applying web application firewall (WAF) rules to detect and block suspicious payloads targeting the display name field.