WordPress Download Manager < 3.3.66 – Author+ Stored XSS via Package Title | CVE 2026-14292

Description

The plugin does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

Proof of Concept

The PoC will be displayed on August 03, 2026, to give users the time to update.

Affects Plugins

download-manager

Fixed in 3.3.66

References

CVE

CVE-2026-14292

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Yaswanth Reddy Sunkara

Submitter

Yaswanth Reddy Sunkara

Verified

Yes

WPVDB ID

719b6675-7891-4742-9751-bba2e72414a8

Timeline

Publicly Published

2026-07-20 (about 13 days ago)

Added

2026-07-20 (about 12 days ago)

Last Updated

2026-07-20 (about 12 days ago)

Other

Published

Title

Published

2014-08-01

Title

Xorbin Digital Flash Clock 1.0 - Flash-based XSS

Published

2024-05-07

Title

Sticky Social Link <= 2.0.1 - Admin+ Stored XSS

Published

2017-04-14

Title

Easy WP Smtp < 1.2.5 - XSS

Published

2024-05-14

Title

Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg < 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-03-13

Title

Beaver Builder Addons by WPZOOM < 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget