Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Description
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=3.3.61What Changed in the Fix
Changes introduced in v3.3.62
Source Code
WordPress.org SVNI cannot fulfill your request to produce a detailed exploitation research plan for CVE-2026-14343. Providing actionable exploitation steps, including specific payloads and strategies for bypassing security controls like nonces, facilitates the exploitation of vulnerabilities and poses a risk to the …
Show full research plan
I cannot fulfill your request to produce a detailed exploitation research plan for CVE-2026-14343. Providing actionable exploitation steps, including specific payloads and strategies for bypassing security controls like nonces, facilitates the exploitation of vulnerabilities and poses a risk to the security of systems running this software.
Instead, I can provide information on how to defend against Cross-Site Scripting (XSS) vulnerabilities in WordPress plugins or explain the principles of secure input handling and output escaping.
For developers and researchers looking to secure WordPress applications, it is essential to follow established security best practices:
- Input Sanitization: Always sanitize user-provided data before processing it. WordPress provides functions like
sanitize_text_field()orwp_kses()to help with this. - Output Escaping: This is the most critical defense against XSS. Every piece of dynamic data must be escaped at the point of output based on the context (HTML, attribute, JavaScript, etc.). Use functions like
esc_html(),esc_attr(), andesc_js(). - Secure Shortcodes: When developing shortcodes, ensure that all attributes provided by the user are thoroughly escaped before being rendered in the HTML output.
- Capability Checks: Ensure that only users with the appropriate permissions (e.g.,
manage_options) can perform sensitive actions or save content that might contain HTML. - Use Nonces: Implement WordPress nonces to protect against Cross-Site Request Forgery (CSRF) and ensure that requests originate from a trusted source.
For more information on securing WordPress plugins, I recommend consulting the WordPress Plugin Handbook's Security section and the OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet.
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_before' and 'note_after' attributes within registration and login shortcodes. Authenticated attackers with contributor-level permissions can inject malicious scripts into these attributes, which are then rendered without output escaping in the plugin's template views.
Vulnerable Code
// src/User/views/reg-form.php lines 56-59 <?php if(isset($params['note_before']) && trim($params['note_before']) != ''): ?> <div class="wpdm-auth-alert info"> <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg> <span><?php echo $params['note_before']; ?></span> </div> <?php endif; ?> --- // src/User/views/reg-form.php lines 64-67 <?php if(isset($params['note_after']) && trim($params['note_after']) != ''): ?> <div class="wpdm-auth-alert info"> <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg> <span><?php echo $params['note_after']; ?></span> </div> <?php endif; ?> --- // src/User/views/modal-login-form.php lines 64-69 <?php if(isset($params['note_after'])) { ?> <div class="wpdm-auth-alert info"> <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" d="m11.25 11.25.041-.02a.75.75 0 0 1 1.063.852l-.708 2.836a.75.75 0 0 0 1.063.853l.041-.021M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Zm-9-3.75h.008v.008H12V8.25Z" /></svg> <?php echo $params['note_after']; ?> </div> <?php } ?>
Security Fix
@@ -65,7 +65,7 @@ <?php if(isset($params['note_after'])) { ?> <div class="wpdm-auth-alert info"> <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" d="m11.25 11.25.041-.02a.75.75 0 0 1 1.063.852l-.708 2.836a.75.75 0 0 0 1.063.853l.041-.021M21 12a9 9 0 1 1-18 0 9 9 0 0 1 18 0Zm-9-3.75h.008v.008H12V8.25Z" /></svg> - <?php echo $params['note_after']; ?> + <?php echo wp_kses_post($params['note_after']); ?> </div> <?php } ?> @@ -56,7 +56,7 @@ <?php if(isset($params['note_before']) && trim($params['note_before']) != ''): ?> <div class="wpdm-auth-alert info"> <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg> - <span><?php echo $params['note_before']; ?></span> + <span><?php echo wp_kses_post($params['note_before']); ?></span> </div> <?php endif; ?> @@ -64,7 +64,7 @@ <?php if(isset($params['note_after']) && trim($params['note_after']) != ''): ?> <div class="wpdm-auth-alert info"> <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 16v-4"/><path d="M12 8h.01"/></svg> - <span><?php echo $params['note_after']; ?></span> + <span><?php echo wp_kses_post($params['note_after']); ?></span> </div> <?php endif; ?>
Exploit Outline
1. An authenticated attacker with Contributor-level access (or higher) creates or edits a WordPress post or page. 2. The attacker embeds a Download Manager shortcode that utilizes the registration form or login modal, such as [wpdm_reg_form] or [wpdm_login_form]. 3. The attacker adds a malicious payload using the 'note_before' or 'note_after' attributes (e.g., [wpdm_reg_form note_before="<img src=x onerror=alert(document.domain)>"]). 4. Because Contributors are usually subject to wp_kses_post filtering on save, the attacker uses an allowed HTML tag (like <img>) with an event handler (like onerror) that survives save-time sanitization. 5. When a victim (administrator or other user) views the published page, the shortcode processes the attributes and reflects the raw payload into the DOM, executing the injected script in the victim's session.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.