CVE-2026-14343

The Download Manager plugin for WordPress contains a vulnerability that allows an authenticated attacker with contributor-level access or higher to inject malicious web scripts into pages. This is due to inadequate filtering of user input in the 'note_before' and 'note_after' shortcode attributes, which can lead to stored cross-site scripting. When a user visits the affected page, the injected scripts will execute, potentially compromising the security of the WordPress site.

Based on public CVE data (MITRE/NVD).