Is CVE-2026-13733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13733 being exploited in the wild.

How severe is CVE-2026-13733?

Medium severity, with a CVSS score of 6.4, published 1 July 2026.

Which products and versions are affected?

codename065 Download Manager up to, and including, 3.3.60.

Is there a fix for CVE-2026-13733?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13733 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13733?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13733: WordPress Download Manager Stored XSS in no_data_msg shortcode

CVE-2026-13733 · Severity: medium · CVSS 6.4 · Published 2026-07-01

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Quick answers

Is CVE-2026-13733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13733 being exploited in the wild.
How severe is CVE-2026-13733?: Medium severity, with a CVSS score of 6.4, published 1 July 2026.
Which products and versions are affected?: codename065 Download Manager up to, and including, 3.3.60.
Is there a fix for CVE-2026-13733?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13733 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13733?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw residing in the 'no_data_msg' shortcode attribute of the Download Manager plugin. The root cause is a failure to properly sanitize input and escape output, specifically regarding C-style escape sequences. While the WordPress 'wp_kses_post' filter is applied to post content, it only targets HTML tokens and fails to neutralize escape sequences within shortcode attributes. An authenticated attacker with Contributor-level permissions or higher can craft a payload that bypasses the filter and reconstructs into a raw script tag during page rendering. This allows for arbitrary JavaScript execution in the context of any user viewing the page.

Affected products

codename065 Download Manager up to, and including, 3.3.60

Timeline

2026-07-01: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.