Threats tagged 'ghsa-mx7c-775g-f79h'

The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the display name field. This affects all versions up to and including 3.3.70. Authenticated users with subscriber-level access or higher can inject malicious scripts via the display name when the [wpdm_edit_profile] shortcode is present on a front-end page. The vulnerability arises from insufficient input sanitization and output escaping, allowing arbitrary script execution when other users access the injected page.