Download Manager package titles let Authors store JavaScript
Download Manager before 3.3.66 does not properly escape a package title in its front-end templates. An Author-or-higher user can save a title containing a script payload, and that JavaScript executes in the browser of any logged-in or anonymous visitor who views a page displaying the package.
- Component
- Download Manager
- Plugin slug
download-manager- Affected
- < 3.3.66
- Safe version
3.3.66- Published
- Aug 01, 2026
This CVE was published Aug 01, 2026 and is one of 70 known issues for this plugin.
Update, patch or deactivate.
Update Download Manager to 3.3.66 or later. Review package titles created or edited by Authors for script content, remove confirmed payloads, and invalidate administrator sessions if a privileged user viewed an affected package page.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N