CVE-2026-14292 is a CWE-79 Cross-Site Scripting vulnerability in the Download Manager WordPress plugin. The issue arises because the plugin fails to properly escape a package's title before outputting it in front-end package templates. Users with the Author role or above can store a crafted title that leads to arbitrary JavaScript execution in the browsers of any user viewing the page, including unauthenticated visitors. This vulnerability affects versions prior to 3.3.66, although no explicit affected versions were provided in the source data. The CVSS v3.1 base score is 5.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, requiring privileges of Author role, user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with Author-level privileges to execute arbitrary JavaScript in the context of any user visiting a page displaying the malicious package title. This can lead to theft of sensitive information, session hijacking, or other client-side attacks affecting confidentiality and integrity. There is no direct impact on availability. The vulnerability affects unauthenticated visitors as well, increasing the potential attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict Author role privileges to trusted users and consider removing or sanitizing package titles manually to prevent injection of malicious scripts.