Junglewise Threat Intelligence

CVE-2026-13733: WordPress Download Manager Stored XSS in no_data_msg shortcode

CVE-2026-13733 · Severity: medium · CVSS 6.4 · Published 2026-07-01

Vendors: Codename065.

Executive brief

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Technical details

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the 'no_data_msg' shortcode attribute of the Download Manager plugin. The root cause is a failure to properly sanitize input and escape output, specifically regarding C-style escape sequences. While the WordPress 'wp_kses_post' filter is applied to post content, it only targets HTML tokens and fails to neutralize escape sequences within shortcode attributes. An authenticated attacker with Contributor-level permissions or higher can craft a payload that bypasses the filter and reconstructs into a raw script tag during page rendering. This allows for arbitrary JavaScript execution in the context of any user viewing the page.

Affected products

  • codename065 Download Manager up to, and including, 3.3.60

Timeline

  • 2026-07-01: advisory: NVD publication date

References