CVE-2024-6208

The Download Manager plugin for WordPress has a security flaw that allows malicious code injection through its 'wpdm_all_packages' shortcode in versions prior to 3.2.97. This weakness arises from inadequate filtering of input data and insufficient protection against script execution on the 'cols' parameter, which can be exploited by authenticated users with contributor-level permissions or higher. As a result, attackers can embed malicious scripts that will run whenever a user visits an affected page.

Based on public CVE data (MITRE/NVD).