Skip to content
fr Sign in
5.4 Medium

CVE-2026-14292 The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in…

Description

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

Affected products and versions

Product Affected versions Fixed in
Download Manager 3.3 earliest → < 3.3.66 3.3.66

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Download Manager

The 19 CVEs of Download Manager →
CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF… 4.3 Medium CVE-2026-86610 The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before… 6.4 Medium CVE-2026-86609 The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its… 8.8 High CVE-2026-14235 The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session… 7.5 High
Track this CVE