CVE-2026-14343

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.62

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the note before and note after shortcode attributes. While wp kses post filters content during saving for users lacking unfiltered html permissions, payloads that bypass this filter can still execute in the browser when the shortcode is rendered.

Recommendations Update to a version newer than 3.3.61. Avoid using the note before and note after attributes in shortcodes until the update is applied.