5.4
Moyenne
CVE-2026-14292 The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in…
Description
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Download Manager 3.3 | premières → < 3.3.66 | 3.3.66 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Download Manager
Les 19 CVE de Download Manager →
CVE-2026-86611
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…
4.3
Moyenne
CVE-2026-86610
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before…
6.4
Moyenne
CVE-2026-86609
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its…
8.8
Élevée
CVE-2026-14235
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session…
7.5
Élevée