CVE-2026-14292

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin versions prior to 3.3.66

Description Insufficient escaping of a package title before it is rendered in front-end package templates allows users with the Author role or higher to perform a Stored Cross-Site Scripting (XSS) attack. By storing a malicious title, an attacker can execute arbitrary JavaScript in the browser of any user who views the affected package page, including unauthenticated visitors.

Recommendations Update the Download Manager WordPress plugin to version 3.3.66 or later.