CVE-2026-13733: Download Manager WordPress Plugin Stored XSS via Shortcode Attribute

Technical summary

The Download Manager plugin processes shortcode attributes without adequate sanitization and escaping. Although the plugin applies wp_kses_post to post content during save operations, this function only strips HTML tokens and does not neutralize C-style escape sequences (such as \x3c, \x3e, or Unicode variants) embedded within shortcode attribute values. An authenticated attacker with contributor-level or higher permissions can construct a payload using these escape sequences in the 'no_data_msg' attribute. During rendering, the plugin silently reconstructs these escape sequences into executable script tags, circumventing the kses filter. The vulnerability affects all versions up to and including 3.3.60 due to insufficient input validation at the shortcode handler level.

Business impact

This vulnerability enables privilege escalation within WordPress sites. Contributors—typically content editors or authors with lower-level access—can execute JavaScript with the permissions of any user who views an affected page, including administrators. An attacker could steal session tokens, modify site content, redirect users to malicious sites, deface pages, or inject malware. On multisite installations, this could affect multiple sites if the plugin is network-activated. The severity is contained by the requirement for authenticated access, but many WordPress sites operate with loose contributor permissions, making this a realistic attack vector.

Affected systems

All versions of the Download Manager plugin for WordPress up to and including version 3.3.60 are vulnerable. The vulnerability requires an authenticated user with contributor-level access or higher (contributor, author, editor, or administrator roles). It only manifests on pages or posts containing the vulnerable shortcode with a crafted 'no_data_msg' attribute. Severity depends on your installation's contributor access policies and user base.

Exploitability

Exploitability is straightforward for anyone with contributor access. No complex technical steps, special configurations, or user interaction beyond viewing a page is required. The attacker does not need admin access to inject the payload—contributor-level permissions suffice. However, the vulnerability is limited to authenticated users; unauthenticated attackers cannot exploit it directly. The barrier to exploitation is low for insiders or compromised accounts with contributor privileges. The payload bypasses WordPress's standard kses filtering, reducing the chance of detection by basic content moderation tools.

Remediation

Update the Download Manager plugin to a patched version released after July 2026. Contact the plugin vendor for the specific patched version number and timeline. As an immediate mitigation, audit your WordPress user roles and remove contributor access from untrusted users. Review all pages and posts containing Download Manager shortcodes for suspicious 'no_data_msg' attribute values containing escape sequences or unusual characters. Consider disabling the plugin entirely if you do not actively use its shortcode functionality. Implement a Web Application Firewall (WAF) rule to detect and block requests containing the shortcode with suspicious attribute patterns.

Patch guidance

Check the WordPress plugin repository or the plugin vendor's website for a security update dated after July 1, 2026. The patch should include sanitization of the 'no_data_msg' attribute and proper escaping during render. Apply the update as soon as it becomes available. Test the updated plugin on a staging environment before deploying to production. Verify that the shortcode continues to function correctly after patching. Document the update in your change management system.

Detection guidance

Search your WordPress database for posts and pages containing Download Manager shortcodes with 'no_data_msg' attributes. Look for unusual escape sequences such as \x, \u, or &#, particularly in patterns like \x3cscript, \x73cript, or similar variants. Check the wp-admin user audit logs for content edits made by contributor-level accounts that inserted or modified such shortcodes. Monitor page views for unexpected JavaScript execution or console errors that may indicate the presence of injected scripts. Use security plugins that scan post content for encoded payloads or anomalous shortcode attributes.

Why prioritize this

Although the CVSS score of 6.4 is moderate, prioritize this vulnerability if your WordPress site has a large contributor base, if you grant frequent contributor access to external partners or clients, or if you have high-value pages that could be defaced or used for credential theft. The stored nature of the attack and the ease of exploitation by insiders make this a higher practical risk than the numeric score suggests. If your contributor user base is small and tightly controlled, remediation can be scheduled in the next routine patch cycle, but it should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects the following factors: Network-accessible attack vector (AV:N), low complexity (AC:L), and requirement for low privileges (PR:L) push severity up. However, the scope is changed (S:C), meaning the impact crosses trust boundaries, which increases the score. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N). The score does not fully capture the insider-threat nature of the vulnerability or the high likelihood of exploitation by disgruntled employees or compromised accounts. The practical risk may be higher in environments with permissive contributor access.

Frequently asked questions