Download Manager CVE-2026-97338

Exploitation requires that the plugin's [wpdm_edit_profile] shortcode be present on a front-end page accessible to Subscriber-level users, and that the site permit subscriber-level (or higher) accounts - commonly via open registration. The attacker must authenticate (PR:L, subscriber or above) and submit a multiply entity-encoded payload through the Display Name field to defeat the insufficient sanitization. Realized impact additionally depends on a privileged user (e.g., an administrator viewing download history/stats) subsequently rendering the stored name, which is what makes the scope-change and cross-user compromise meaningful. Limiting factors: no special configuration means NO exploitation - sites without the edit-profile shortcode on a subscriber-reachable page, or with registration disabled, are not exploitable via this path.

This is a moderate-risk, conditionally-exploitable issue rather than a top priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) reflects a network-reachable stored XSS requiring only subscriber-level authentication (PR:L), with a scope change (S:C) because injected script executes in the browsers of other users who view the page. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk here is driven by the plugin's install footprint and the low authentication bar, not by confirmed in-the-wild activity. The signals are internally consistent (no conflict between vector and description), but exploitation is gated by a specific non-default prerequisite: the [wpdm_edit_profile] shortcode must be placed on a front-end page reachable by subscribers. The absence of EPSS/KEV/POC data is a gap in the intelligence set, not a contradiction. Net: a legitimate patch-soon item for sites that expose the edit-profile shortcode and allow open subscriber registration, but low real-world urgency where that shortcode is not deployed.

A site allows open registration and has placed the [wpdm_edit_profile] shortcode on a front-end page; an attacker registers a subscriber account and edits their Display Name to contain a multiply entity-encoded JavaScript payload that evades the plugin's sanitization. When an administrator or other user later views a page rendering that display name (such as download statistics/history views), the script executes in their browser, enabling session or privilege-escalation attacks. No public exploit code was provided in the input.