CVE-2026-97338 codename065 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Download Manager plugin should assess exposure and prioritize verification and remediation. This includes reviewing user access, input sanitization, and output escaping measures. Additionally, defenders should monitor for suspicious activity and injected web scripts. Prioritization is crucial due to the medium CVSS score of 6.4, indicating a moderate severity vulnerability.

Why it matters

CVE-2026-97338 is a Stored Cross-Site Scripting vulnerability in the Download Manager plugin for WordPress. Defenders should prioritize verification, remediation, and monitoring to prevent exploitation and potential attacks.

• Defenders must verify and update the Download Manager plugin to prevent exploitation.
• Reviewing user access and input sanitization is crucial to prevent similar vulnerabilities.
• Monitoring for suspicious activity and injected web scripts is necessary to detect potential attacks.
• Defenders should prioritize remediation due to the medium CVSS score of 6.4.

Technical summary

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70. This is due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users.

Defensive priority

Defenders should prioritize verifying and updating the Download Manager plugin, reviewing user access and input sanitization, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update the Download Manager plugin to the latest version
• Review user access and permissions for the [wpdm_edit_profile] shortcode
• Monitor for suspicious activity and injected web scripts
• Implement additional input sanitization and output escaping measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by [email protected], with details from the WordPress plugin repository and CVE Program records. The report included information about the vulnerability's existence in all versions up to, and including, 3.3.70 of the Download Manager plugin. The CVE Program record and WordPress plugin repository provide additional context on the vulnerability. However, the exact scope of affected deployments and potential impact is not explicitly stated. Defenders should verify the presence of the vulnerable plugin,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.