5 matches found
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14292 WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14292 WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
CVE-2026-14292
The Download Manager WordPress plugin (versions before 3.3.66 ) contains a stored XSS vulnerability. The issue stems from the failure to properly escape a package's title before it is rendered in front-end package templates. This allows users with the Author role or higher to inject a malicious t...