Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-14292

WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Downloadmanager Wordpress
Products
Download Manager Wordpress
CVE-2026-14235

WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Downloadmanager Wordpress
Products
Download Manager Wordpress