CVE-2026-14292

The CVE concerns the WordPress plugin Download Manager prior to version 3.3.66. The vulnerability arises because the package title is not properly escaped before being output in front-end templates, enabling stored cross-site scripting (XSS) by users with the Author role or higher. This can lead ...

CVE-2026-14292

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...