Stored Cross-Site Scripting Vulnerability in Download Manager Plugin for WordPress

CVE-2026-13733

What is CVE-2026-13733?

The Download Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through the 'no_data_msg' shortcode attribute due to inadequate input sanitization and output escaping. Authenticated users with contributor access and higher can exploit this vulnerability, allowing them to inject malicious web scripts into pages. Although certain functions are applied to sanitize content upon saving, they fail to neutralize C-style escape sequences in shortcode attributes. This oversight can lead to a situation where crafted payloads bypass filters, resulting in harmful scripts being executed when users access the affected pages.

References