[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5PoMVmyQ2xXCBmPuKfpU44S8XXIJQoLGjJ8XBvJ-n-8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-13733","download-manager-authenticated-contributor-stored-cross-site-scripting-via-nodatamsg-shortcode-attribute","Download Manager \u003C= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute","The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.","download-manager",null,"\u003C=3.3.60","3.3.61","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 18:55:18","2026-07-01 07:53:38",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Febf96aa9-2ee7-4411-8f43-3e8d023197bd?source=api-prod",1,[22,23,24,25],"download-manager.php","readme.txt","src\u002FPackage\u002FShortcodes.php","src\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php","researched",false,3,"I cannot fulfill your request to analyze this specific vulnerability or provide an exploitation plan and payloads. I am prohibited from generating actionable materials for the exploitation of software vulnerabilities, including proof-of-concept payloads or step-by-step guides for attacking specific targets.\n\nFor information on how to secure WordPress plugins against Stored Cross-Site Scripting (XSS) and other vulnerabilities, I recommend searching for the following security practices online:\n\n*   **WordPress Plugin Handbook on Security**: Specifically the sections on \"Sanitizing Input\" and \"Escaping Output.\"\n*   **OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet**: For general best practices on handling user-controlled data.\n*   **Secure Implementation of WordPress Shortcodes**: Researching how to use `shortcode_atts()` and ensure all attribute values are escaped using functions like `esc_attr()` or `wp_kses()` before being rendered in HTML.\n*   **Neutralizing C-style Escape Sequences**: Best practices for sanitizing input strings to prevent the reconstruction of HTML tags from escaped characters.","The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_data_msg' shortcode attribute in versions up to 3.3.60. Authenticated attackers with contributor-level permissions or higher can inject malicious JavaScript into the shortcode, which is subsequently executed in the browser of any user viewing the page when no packages are found.","\u002F\u002F src\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php line 396 (approx)\n\n\u003C?php echo isset($params['no_data_msg']) && $params['no_data_msg']!=''?$params['no_data_msg']:__('No Packages Found','download-manager'); ?>\n\n---\n\n\u002F\u002F src\u002FPackage\u002FShortcodes.php\n\n\u002F\u002F Within the allPackages method, the $params array is used to pass user-controlled \n\u002F\u002F shortcode attributes directly to the view without sanitization.\nfunction allPackages($params = [])\n{\n    \u002F\u002F ... (logic to fetch packages)\n    include Template::locate(\"all-packages-shortcode.php\", dirname(__FILE__) . '\u002Fviews');\n    \u002F\u002F ...\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.60\u002Fsrc\u002FPackage\u002FShortcodes.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.61\u002Fsrc\u002FPackage\u002FShortcodes.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.60\u002Fsrc\u002FPackage\u002FShortcodes.php\t2026-06-28 05:51:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.61\u002Fsrc\u002FPackage\u002FShortcodes.php\t2026-06-30 05:02:18.000000000 +0000\n@@ -401,6 +401,14 @@\n \n \t    $params = __::a($params, ['items_per_page' => 20]);\n \n+        \u002F\u002F Defense-in-depth: a contributor-supplied \"no data\" message must not be\n+        \u002F\u002F able to smuggle markup into the shortcode output. sanitize_text_field()\n+        \u002F\u002F strips literal tags here and the value is also escaped with esc_html()\n+        \u002F\u002F at render time (neutralizing entity-encoded payloads like <script>).\n+        if (isset($params['no_data_msg'])) {\n+            $params['no_data_msg'] = sanitize_text_field($params['no_data_msg']);\n+        }\n+\n         $items = isset($params['items_per_page']) && $params['items_per_page'] > 0 ? (int)$params['items_per_page'] : 20;\n         $offset = $cp = 0;\n         if (isset($params['jstable']) && (int)$params['jstable'] === 1) {\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.60\u002Fsrc\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.61\u002Fsrc\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.60\u002Fsrc\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php\t2025-12-26 03:47:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fdownload-manager\u002F3.3.61\u002Fsrc\u002FPackage\u002Fviews\u002Fall-packages-shortcode.php\t2026-06-30 05:02:18.000000000 +0000\n@@ -393,7 +393,7 @@\n                 \u003Ctr>\n                     \u003Ctd colspan=\"4\" class=\"text-center\">\n \n-                        \u003C?php echo isset($params['no_data_msg']) && $params['no_data_msg']!=''?$params['no_data_msg']:__('No Packages Found','download-manager'); ?>\n+                        \u003C?php echo isset($params['no_data_msg']) && $params['no_data_msg']!='' ? esc_html($params['no_data_msg']) : __('No Packages Found','download-manager'); ?>\n \n                     \u003C\u002Ftd>\n                 \u003C\u002Ftr>","1. Login as a Contributor or higher-privileged user.\n2. Create or edit a post\u002Fpage and insert the following shortcode: `[wpdm_all_packages no_data_msg=\"\u003Cscript>alert(origin)\u003C\u002Fscript>\" categories=\"non-existent-category\"]`.\n3. The `categories` attribute is set to a non-existent category to ensure the query returns no results, triggering the display of the `no_data_msg`.\n4. Publish or preview the post.\n5. When any user views the post, the plugin processes the shortcode, finds no items, and echoes the raw `no_data_msg` attribute into the HTML table, executing the attacker's script.","gemini-3-flash-preview","2026-07-25 12:45:44","2026-07-25 12:46:43",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","3.3.60","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdownload-manager\u002Ftags\u002F3.3.60","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdownload-manager.3.3.60.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdownload-manager\u002Ftags\u002F3.3.61","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdownload-manager.3.3.61.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdownload-manager\u002Ftags"]