CVE-2024-10706

The Download Manager plugin for WordPress contains a stored cross-site scripting vulnerability in its administrator settings that affects all versions through 3.3.02. Attackers with administrator access can inject malicious scripts into the plugin's settings due to inadequate sanitization and escaping of user input. When other users view pages containing the injected code, the scripts execute in their browsers. This vulnerability only impacts multisite WordPress installations or sites where unfiltered HTML capability has been restricted.

Based on public CVE data (MITRE/NVD).