CVE-2026-14292 — WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the A…
Published: 2026-08-01 · CVSS: 5.4 · CVSS 3.1
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7