What is the CVSS score of CVE-2026-14292?

CVE-2026-14292 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14292?

Yes, a public proof-of-concept exploit is available for CVE-2026-14292. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14292?

Yes, a patch is available for CVE-2026-14292. Update the affected software to the latest version immediately.

Download Manager CVE-2026-14292

EUVD-2026-51706 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 WPScan

GHSA-j3p8-jcxf-rxwr

WordPress XSS Download Manager Unknown

5.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Author-role authentication required (PR:L), victim must visit affected page (UI:R), scope changes to victim browser (S:C); no availability impact on either system.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:24 vuln.today

CVSS changed

Aug 03, 2026 - 19:22 NVD

5.4 (MEDIUM)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

AnalysisAI

Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.

Technical ContextAI

This is a persistent (stored) cross-site scripting vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Download Manager WordPress plugin fails to apply proper HTML output escaping to package title fields before rendering them inside front-end page templates. Because the payload is stored server-side and rendered to all subsequent visitors, the blast radius extends to any user - authenticated or not - who loads the affected page. The WordPress Author role is a low-privilege but commonly granted role on multi-author sites, meaning the attack surface exists wherever contributors or guest bloggers are present. Per CPE cpe:2.3:a:unknown:download_manager:*:*:*:*:*:*:*:*, all plugin versions prior to 3.3.66 carry this flaw. The CVSS scope flag S:C reflects the cross-boundary impact: the injection occurs in the WordPress application context but the harm manifests in the victim's browser context.

RemediationAI

Update the Download Manager WordPress plugin to version 3.3.66 or later, which introduces proper escaping of package titles in front-end templates. The patch is vendor-confirmed and available via the WordPress plugin repository; the WPScan advisory at https://wpscan.com/vulnerability/719b6675-7891-4742-9751-bba2e72414a8/ provides additional context. If immediate patching is not feasible, reduce the Author role to only fully trusted users - this eliminates the injection vector but may disrupt multi-author workflows. There is no technical workaround that preserves full plugin functionality without applying the patch. Sites that do not display download packages on public-facing pages have a reduced but not eliminated attack surface, since any page serving a malicious package title would trigger the payload.