CVE-2026-14292: Download Manager WordPress XSS Vulnerability

CVE-2026-14292 Overview

CVE-2026-14292 is a stored Cross-Site Scripting (XSS) vulnerability in the Download Manager WordPress plugin versions prior to 3.3.66. The plugin fails to escape a package's title before rendering it in front-end package templates. Authenticated users with the Author role or above can inject arbitrary JavaScript into a package title. That payload executes in the browser of any visitor who views the affected package page, including unauthenticated users.

Critical Impact
Attackers with Author-level access can persistently inject JavaScript that runs in every visitor's browser, enabling session theft, credential harvesting, and drive-by redirection.

Affected Products

Download Manager WordPress plugin versions before 3.3.66
WordPress sites permitting Author-role registration or delegation
Front-end package template rendering paths within the plugin

Discovery Timeline

2026-08-01 - CVE-2026-14292 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-14292

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The Download Manager plugin accepts package titles from authenticated users and stores them in the database. When the front-end template renders a package listing or detail page, the title is emitted into HTML without proper escaping. Any HTML or JavaScript embedded in the title executes in the visitor's browser context.

The attack requires an authenticated account with the Author role or higher. User interaction is required in that a victim must visit a page displaying the affected package. Because the payload persists in the database, a single injection affects every subsequent visitor, including unauthenticated users browsing public download pages. The scope changes because injected script executes in the trusted origin of the WordPress site.

Root Cause

The root cause is missing output encoding in the front-end package template code path. The plugin trusts stored package titles and emits them into HTML without calling WordPress escaping functions such as esc_html() or esc_attr(). Because the field is user-controlled and rendered in a security-sensitive HTML context, absent escaping directly yields script injection.

Attack Vector

An attacker with Author privileges creates or edits a Download Manager package. The attacker sets the package title to a string containing an HTML tag with executable JavaScript, for example an <img> or <svg> tag carrying an event handler. After the package is published, the malicious title renders on any page that displays the package. Visitors execute the attacker's script under the site's origin, permitting cookie theft, forced administrative actions via CSRF, defacement, or redirection to malware-hosting infrastructure.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2026-14292

Indicators of Compromise

Download Manager package titles containing HTML tags such as <script>, <img>, <svg>, or <iframe>
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading package pages
New or modified wp_posts rows with post_type matching Download Manager packages authored by low-privilege accounts
Author-role accounts created or elevated shortly before package creation events

Detection Strategies

Query the WordPress database for package titles matching HTML tag or event-handler patterns such as on\w+\s*= or javascript:
Monitor web server access logs for requests to Download Manager package URLs followed by anomalous third-party script loads
Enable Content Security Policy (CSP) report-only mode to surface inline script executions originating from package pages

Monitoring Recommendations

Audit creation and modification of Author-role accounts and correlate with subsequent Download Manager package edits
Alert on WordPress edit_post and publish_post actions that include HTML control characters in the post title field
Track browser-side JavaScript errors and CSP violations reported from front-end package templates

How to Mitigate CVE-2026-14292

Immediate Actions Required

Update the Download Manager WordPress plugin to version 3.3.66 or later immediately
Review all existing package titles for embedded HTML or script content and sanitize or remove offending entries
Audit the list of accounts with Author role or higher and revoke access for accounts that no longer require it

Patch Information

The vendor released Download Manager version 3.3.66, which properly escapes package titles before output in front-end templates. Administrators should install the patched release through the WordPress plugin updater. Refer to the WPScan Vulnerability Report for advisory references.

Workarounds

Restrict the Author role to trusted users only until patching is complete
Deploy a Web Application Firewall (WAF) rule blocking HTML tags in POST parameters targeting Download Manager package endpoints
Implement a strict Content Security Policy disallowing inline scripts on pages that render Download Manager templates
Temporarily disable the Download Manager plugin if patching cannot be performed promptly

bash

# Configuration example: enforce Content Security Policy at the web server
# Apache .htaccess directive to block inline scripts on package pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"