Stored Cross-Site Scripting in Download Manager Plugin for WordPress

CVE-2026-14343

What is CVE-2026-14343?

The Download Manager plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting via the 'note_before' and 'note_after' Shortcode Attributes. This issue affects all versions up to and including 3.3.61 due to inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access can inject malicious web scripts into pages that execute when a user views the affected content. While the wp_kses_post function helps filter out unsafe content during save operations, it fails to protect against certain payloads that, despite being sanitized, can execute in the user's browser when rendered. This poses a significant security risk for websites utilizing this plugin.

References