CVE-2026-13733

The Download Manager plugin for WordPress has a security flaw in versions up to 3.3.60 that allows attackers with contributor-level access or higher to inject malicious code into pages, which will be executed when users visit those pages. This vulnerability arises from the plugin's failure to properly filter and sanitize input data, particularly in shortcode attributes. As a result, contributors can craft malicious payloads that evade filtering and are reconstructed as raw script tags at rendering time.

Based on public CVE data (MITRE/NVD).