CVE-2024-4001

The Download Manager plugin for WordPress contains a stored cross-site scripting vulnerability in the 'wpdm_modal_login_form' shortcode affecting versions 3.2.93 and earlier. Authenticated users with contributor-level permissions or higher can inject malicious scripts through insufficiently sanitized shortcode attributes. These injected scripts will execute in the browsers of any user who visits the affected page. The vulnerability stems from a failure to properly sanitize input and escape output when processing user-supplied shortcode parameters.

Based on public CVE data (MITRE/NVD).