Is CVE-2026-14343 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14343 being exploited in the wild.

How severe is CVE-2026-14343?

Medium severity, with a CVSS score of 6.4, published 9 July 2026.

Which products and versions are affected?

codename065 Download Manager up to, and including, 3.3.61.

Is there a fix for CVE-2026-14343?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14343 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14343?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14343: WordPress Download Manager Stored XSS in Shortcode Attributes

CVE-2026-14343 · Severity: medium · CVSS 6.4 · Published 2026-07-09

The Download Manager plugin for WordPress, which is used to manage and track file downloads, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users or administrators visit the affected pages. This could lead to unauthorized actions being performed in the context of a victim's browser, potentially compromising user sessions or site content.

Quick answers

Is CVE-2026-14343 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14343 being exploited in the wild.
How severe is CVE-2026-14343?: Medium severity, with a CVSS score of 6.4, published 9 July 2026.
Which products and versions are affected?: codename065 Download Manager up to, and including, 3.3.61.
Is there a fix for CVE-2026-14343?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14343 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14343?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'note_before' and 'note_after' shortcode attributes. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into pages. While WordPress's 'wp_kses_post' function filters some content for users without 'unfiltered_html' capabilities, certain payloads can still bypass these filters and reach an unsafe unescaped sink. When a user views the page where the shortcode is rendered, the malicious script executes in their browser. The vulnerability is present in all versions up to and including 3.3.61.

Affected products

codename065 Download Manager up to, and including, 3.3.61

Timeline

2026-07-09: disclosed
2026-07-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.