# CVE-2026-14292: WPDM Download Manager stored XSS in package title

Source: https://junglewise.ai/threats/cve-2026-14292-wpdm-download-manager-stored-xss-in-package-title  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-14292 · Severity: info · CVSS 6.8 · Published 2026-08-01

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with 'Author' privileges to inject malicious scripts into file titles. When other users, including site administrators or regular visitors, view the page containing the affected file, the malicious script will run in their browser. This could lead to unauthorized actions being performed on behalf of the victim, such as stealing session information or redirecting users to malicious websites.

## Quick answers

**Is CVE-2026-14292 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14292 being exploited in the wild.

**How severe is CVE-2026-14292?** Informational severity, with a CVSS score of 6.8, published 1 August 2026.

**Which products and versions are affected?** WPDM Download Manager < 3.3.66.

**Is there a fix for CVE-2026-14292?** A patch was published on 2026-07-20: Fixed in version 3.3.66 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14292 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14292?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Download Manager plugin for WordPress in versions prior to 3.3.66. The issue stems from the plugin's failure to properly escape package titles before rendering them in front-end templates. An attacker with at least 'Author' role privileges can save a package with a title containing arbitrary JavaScript. This script is then executed in the context of any user's browser who visits the page where the package is displayed. The vulnerability is tracked as CWE-79 and was addressed in version 3.3.66.

## Affected products

- WPDM Download Manager < 3.3.66

## Timeline

- 2026-07-20: disclosed
- 2026-07-20: patched: Fixed in version 3.3.66
- 2026-08-01: advisory

## References

- [https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/](https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/)