CVE-2026-13733 Overview
CVE-2026-13733 is a stored Cross-Site Scripting (XSS) vulnerability in the Download Manager plugin for WordPress, affecting all versions up to and including 3.3.60. The flaw resides in the handling of the no_data_msg shortcode attribute, where insufficient input sanitization and output escaping allow authenticated users with contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who views an affected page. The vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, credential harvesting, and privileged action hijacking against site administrators.
Affected Products
- WordPress Download Manager plugin versions up to and including 3.3.60
- WordPress sites permitting contributor-level accounts with shortcode usage
- Any WordPress deployment rendering the no_data_msg shortcode attribute
Discovery Timeline
- 2026-07-01 - CVE-2026-13733 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13733
Vulnerability Analysis
The Download Manager plugin exposes shortcodes that accept user-controlled attributes, including no_data_msg, which specifies a message rendered when no download packages are available. Contributor-level users can embed this shortcode in draft posts, populating the attribute with a crafted payload. When an editor or administrator previews or publishes the page, the shortcode processor reconstructs the attribute into rendered HTML without adequate escaping.
Although the plugin relies on WordPress wp_kses_post to filter post content on save, wp_kses_post only strips known-bad HTML tokens. It does not neutralize C-style escape sequences embedded within shortcode attribute values. As a result, a payload encoded with escape sequences survives the kses filter and is silently reassembled into a raw <script> tag at render time.
Root Cause
The root cause is the mismatch between the sanitization layer applied at save time and the reconstruction logic applied at render time. wp_kses_post operates on HTML tokens rather than shortcode attribute semantics. The shortcode rendering path in src/Package/Shortcodes.php and src/Package/views/all-packages-shortcode.php decodes escape sequences and outputs the attribute value without applying esc_html, esc_attr, or equivalent context-appropriate escaping.
Attack Vector
An attacker requires an authenticated account with contributor privileges or higher. The attacker creates a post containing the Download Manager shortcode with a malicious no_data_msg attribute value that uses escape sequences to hide script content from wp_kses_post. Once the post is published or previewed by a higher-privileged user, the reconstructed <script> executes in that user's browser session, enabling account takeover, session token theft, or unauthorized administrative actions.
No verified public proof-of-concept code is available. Technical implementation details are documented in the Wordfence Vulnerability Report and the affected source files referenced in the WordPress Shortcodes Source Code.
Detection Methods for CVE-2026-13733
Indicators of Compromise
- Posts or pages authored by contributor-level accounts containing the Download Manager shortcode with unusual no_data_msg attribute values
- Rendered pages that emit <script> tags originating from shortcode output rather than theme or plugin templates
- Outbound requests from visitor browsers to unfamiliar domains after loading pages containing Download Manager shortcodes
- Unexpected administrative actions or session activity following contributor content publication
Detection Strategies
- Audit the wp_posts table for shortcode attributes containing escape sequences such as \\x3c, \\u003c, or backslash-encoded quotes within no_data_msg
- Deploy web application firewall rules to inspect shortcode attributes for encoded script markers before rendering
- Enable Content Security Policy (CSP) reporting to surface inline script execution on public-facing pages
Monitoring Recommendations
- Log and review all contributor and author post submissions containing shortcodes prior to publication
- Monitor administrative session activity for anomalies following page previews of contributor-submitted content
- Track plugin file integrity for Shortcodes.php and all-packages-shortcode.php in the Download Manager plugin directory
How to Mitigate CVE-2026-13733
Immediate Actions Required
- Update the WordPress Download Manager plugin to a version newer than 3.3.60 once the vendor publishes a fix incorporating WordPress Change Set 3590868
- Review contributor and author accounts, revoking access for untrusted or dormant users
- Audit existing posts and pages for the Download Manager shortcode and remove suspicious no_data_msg values
Patch Information
The upstream fix is tracked in WordPress Change Set 3590868. Site administrators should apply the corresponding plugin update through the WordPress admin dashboard or via WP-CLI. Details of the affected code paths are available in the Wordfence Vulnerability Report.
Workarounds
- Restrict contributor role capabilities to prevent shortcode usage until the plugin is updated
- Disable the Download Manager plugin on sites that permit low-privilege content authorship
- Enforce a strict Content Security Policy that disallows inline scripts on public pages rendering plugin shortcodes
- Route all rendered pages through a web application firewall configured to strip encoded script sequences from shortcode output
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
