Vulnerability · Published Aug 1, 2026 · Assigned by WPScan
CVE-2026-14292WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
Medium 5.4
In plain English
A medium-severity cross-site scripting in Download Manager from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Download Manager | 0 – before 3.3.66 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/ exploit, vdb-entry, technical-description