CVE-2026-14343: WordPress Download Manager Stored XSS via Shortcode Attributes

Technical summary

The vulnerability exists in the Download Manager plugin's handling of shortcode attributes. The 'note_before' and 'note_after' parameters are passed to shortcode rendering without proper output escaping, despite WordPress's content filtering mechanism (wp_kses_post). While WordPress's built-in kses filtering removes certain dangerous HTML tags and attributes during post save for users lacking the unfiltered_html capability, the shortcode rendering sink itself does not escape output. This means that payloads surviving the save-time filter can still execute as JavaScript in the user's browser when the shortcode is rendered on the frontend. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

A compromised WordPress site using Download Manager can serve malicious JavaScript to visitors, enabling attackers to steal session cookies, redirect users to phishing sites, harvest credentials, or perform actions on behalf of legitimate users. If the injected script targets administrators, attackers could gain administrative control. The persistent nature of stored XSS means the attack continues until the malicious shortcode is manually removed. For organizations relying on WordPress for content delivery, customer-facing sites, or internal documentation, this vulnerability poses a material risk to user trust and data security.

Affected systems

Download Manager plugin for WordPress versions 3.3.61 and earlier. The vulnerability requires authenticated access (contributor level or above), so it does not affect sites with strict user permission controls or those with no user accounts beyond administrator. Sites with contributor or editor accounts face elevated risk, particularly if those accounts are shared, weak, or belong to former employees with retained access.

Exploitability

Exploitation requires valid WordPress authentication at the contributor level or above. An attacker with legitimate or compromised contributor credentials can inject a malicious shortcode into any post or page, and the payload executes automatically when any user (including unauthenticated visitors) views that content. No additional user interaction or victim-side action is required. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects this: network-accessible, low attack complexity, low privilege requirement, no user interaction needed, and cross-site impact. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade the Download Manager plugin to a patched version released after July 9, 2026. Verify the vendor advisory for the specific patched version number. Additionally, conduct an immediate audit of user accounts with contributor access and above—disable or reset credentials for unnecessary or dormant accounts. Search the WordPress database for any existing malicious shortcodes containing 'note_before' or 'note_after' attributes with suspicious content. Consider temporarily disabling the Download Manager plugin if patching is delayed.

Patch guidance

Check the official Download Manager plugin repository or the vendor's security advisory for the patched version number. After updating, test the plugin on a staging environment before deploying to production. Be aware that the patch should include proper output escaping (likely using esc_attr() or esc_html()) for the vulnerable shortcode attributes. Verify that the patch is applied to all WordPress installations using this plugin, including multisite installations where the plugin may be network-activated.

Detection guidance

Monitor WordPress post and page revisions for suspicious additions to shortcodes containing 'note_before' or 'note_after' attributes with JavaScript payloads, data URLs, or event handlers (e.g., 'onclick', 'onerror'). Check web server logs and WordPress audit logs for contributor account activity creating or modifying pages post-compromise. Deploy Web Application Firewall (WAF) rules to detect and block attempts to execute JavaScript through shortcode parameters. Consider WordPress security plugins that detect stored XSS patterns or unusual post modifications. Implement Content Security Policy (CSP) headers to mitigate the impact of injected scripts even if the vulnerability is exploited.

Why prioritize this

Although rated CVSS 6.4 (Medium), this vulnerability warrants prompt attention because: (1) it allows stored XSS execution without user interaction; (2) it affects publicly accessible WordPress sites; (3) it requires only authenticated access, which many WordPress sites grant liberally to content editors; (4) the persistent nature means a single exploit compromises all page visitors indefinitely until remediated; and (5) the cross-site impact (S:C in the CVSS vector) means it can affect site functionality and user trust broadly.

Risk score, explained

The CVSS 6.4 (Medium) score reflects moderate but real risk. The score accounts for the requirement of authenticated access (PR:L) and lack of availability impact (A:N), which prevent a higher rating. However, the lack of user interaction requirement (UI:N), network accessibility (AV:N), and cross-site scope (S:C) ensure it is not scored lower. In a practical context, the risk is elevated for organizations with many contributor accounts or those managing customer-facing content, where a single compromised account or insider threat can affect numerous users.

Frequently asked questions