Unrated severityNVD Advisory· Published Aug 1, 2026· Updated Aug 3, 2026
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
CVE-2026-14292
Description
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.3.66
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.