Is Download Manager safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (3.3.75). As of 2026-11-04. 71 issues are on record for older versions; version 3.3.72 or newer fixes all of them that state a fix. Keep Download Manager on the latest version (3.3.75) and remove it if you do not use it.

Which versions of Download Manager are vulnerable?

Known issues on record (newest first): Cross-site request forgery (CSRF) (older than 3.3.71, 4.0.0 up to (not including) 7.5.9, fixed in 3.3.71); Reflected cross-site scripting (XSS) (3.3.57 and older, fixed in 3.3.58); Stored cross-site scripting (XSS) (3.3.58 and older, fixed in 3.3.59); Information disclosure (3.3.71 and older, fixed in 3.3.72); Stored cross-site scripting (XSS) (3.3.71 and older, fixed in 3.3.72); Missing authorization check (3.3.71 and older, fixed in 3.3.72). The full list with sources is on this page.

What is the latest version of Download Manager?

3.3.75, according to wordpress.org (last updated 2026-11-01). It has 100,000+ active installs.

What should I do if my Download Manager is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update download-manager). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · download-manager · data as of 2026-11-04

Is Download Manager safe? Known vulnerabilities and latest version

Latest version: 3.3.75
Last updated: 2026-11-01
Active installs: 100,000+
Known issues on record: 71
Unpatched in latest: 0
Tested up to WP: 7.1.4

This File Management & Digital Store plugin will help you to control file downloads & sell digital products from your WP site. — by Shahjada

What to do

Update to the latest version (3.3.75). Anything older than 3.3.72 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get download-manager --field=version shows what you run; wp plugin update download-manager updates it.

Check your version

Known vulnerabilities

71 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 4.3 CVE-2026-86611 · published 2026-10-21

Cross-site request forgery (CSRF) in Download Manager (older than 3.3.71, 4.0.0 up to (not including) 7.5.9)

Affected: older than 3.3.71, 4.0.0 up to (not including) 7.5.9
Fixed in: 3.3.71
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Download Manager release on wordpress.org (3.3.75), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.

NVD CVE-2026-86611 WPScan advisory

medium 6.1 CVE-2026-12054 · published 2026-10-10

Reflected cross-site scripting (XSS) in Download Manager (3.3.57 and older)

Affected: 3.3.57 and older
Fixed in: 3.3.58 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

NVD CVE-2026-12054 Wordfence advisory Code change (fix)

medium 6.4 CVE-2026-9696 · published 2026-10-10

Stored cross-site scripting (XSS) in Download Manager (3.3.58 and older)

Affected: 3.3.58 and older
Fixed in: 3.3.59 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2026-9696 Wordfence advisory Code change (fix)

medium 4.3 CVE-2026-103964 · published 2026-10-10

Information disclosure in Download Manager (3.3.71 and older)

Affected: 3.3.71 and older
Fixed in: 3.3.72 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.

NVD CVE-2026-103964 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-102401 · published 2026-10-10

Stored cross-site scripting (XSS) in Download Manager (3.3.71 and older)

Affected: 3.3.71 and older
Fixed in: 3.3.72 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected.

NVD CVE-2026-102401 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2026-94405 · published 2026-10-02

Missing authorization check in Download Manager (3.3.71 and older)

Affected: 3.3.71 and older
Fixed in: 3.3.72 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.

NVD CVE-2026-94405 Patchstack advisory

medium 6.4 CVE-2026-97338 · published 2026-10-02

Stored cross-site scripting (XSS) in Download Manager (3.3.70 and older)

Affected: 3.3.70 and older
Fixed in: 3.3.71 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.

NVD CVE-2026-97338 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-86610 · published 2026-10-01

Stored cross-site scripting (XSS) in Download Manager (older than 3.3.71)

Affected: older than 3.3.71
Fixed in: 3.3.71
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.

NVD CVE-2026-86610 WPScan advisory

medium 6.5 CVE-2026-92714 · published 2026-09-18

Missing authorization check in Download Manager (3.3.68 and older)

Affected: 3.3.68 and older
Fixed in: 3.3.69 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.

NVD CVE-2026-92714 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-16685 · published 2026-08-01

Stored cross-site scripting (XSS) in Download Manager (3.3.66 and older)

Affected: 3.3.66 and older
Fixed in: 3.3.67 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.

NVD CVE-2026-16685 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2026-14292 · published 2026-08-01

Cross-site scripting (XSS) in Download Manager (older than 3.3.66)

Affected: older than 3.3.66
Fixed in: 3.3.66
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

NVD CVE-2026-14292 WPScan advisory

high 7.5 CVE-2026-14235 · published 2026-07-27

Missing authorization check in Download Manager (older than 3.3.62)

Affected: older than 3.3.62
Fixed in: 3.3.62
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

NVD CVE-2026-14235 WPScan advisory

medium 6.4 CVE-2026-14343 · published 2026-07-09

Stored cross-site scripting (XSS) in Download Manager (3.3.61 and older)

Affected: 3.3.61 and older
Fixed in: 3.3.62 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.

NVD CVE-2026-14343 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-13733 · published 2026-07-01

Stored cross-site scripting (XSS) in Download Manager (3.3.60 and older)

Affected: 3.3.60 and older
Fixed in: 3.3.61 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.

NVD CVE-2026-13733 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2026-4057 · published 2026-04-10

Missing authorization check in Download Manager (3.3.51 and older)

Affected: 3.3.51 and older
Fixed in: 3.3.52 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.

NVD CVE-2026-4057 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2026-5357 · published 2026-04-09

Stored cross-site scripting (XSS) in Download Manager (3.3.52 and older)

Affected: 3.3.52 and older
Fixed in: 3.3.53 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdm_members' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

NVD CVE-2026-5357 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2026-39676 · published 2026-04-08

Missing authorization check in Download Manager (3.3.52 and older)

Affected: 3.3.52 and older
Fixed in: 3.3.53
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

NVD CVE-2026-39676 Patchstack advisory

medium 5.9 CVE-2026-39615 · published 2026-04-08

Stored cross-site scripting (XSS) in Download Manager (3.3.53 and older)

Affected: 3.3.53 and older
Fixed in: 3.3.54 *
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.

NVD CVE-2026-39615 Patchstack advisory

medium 4.3 CVE-2026-2571 · published 2026-03-19

Missing authorization check in Download Manager (3.3.49 and older)

Affected: 3.3.49 and older
Fixed in: 3.3.50 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.

NVD CVE-2026-2571 Wordfence advisory Code change (fix)Plugin source

medium 6.1 CVE-2026-1666 · published 2026-02-18

Reflected cross-site scripting (XSS) in Download Manager (3.3.46 and older)

Affected: 3.3.46 and older
Fixed in: 3.3.47 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

NVD CVE-2026-1666 Wordfence advisory Code change (fix)wpdownloadmanager.com Plugin source

high 7.3 CVE-2025-15364 · published 2026-01-06

Privilege escalation in Download Manager (3.3.40 and older)

Affected: 3.3.40 and older
Fixed in: 3.3.41 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.

NVD CVE-2025-15364 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2025-13498 · published 2025-12-18

Missing authorization check in Download Manager (3.3.32 and older)

Affected: 3.3.32 and older
Fixed in: 3.3.33 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.

NVD CVE-2025-13498 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2025-63070 · published 2025-12-09

Information disclosure in Download Manager (3.3.32 and older)

Affected: 3.3.32 and older
Fixed in: 3.3.33
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32.

NVD CVE-2025-63070 Patchstack advisory

medium 5.3 CVE-2025-12177 · published 2025-11-08

Security issue in Download Manager (3.3.30 and older)

Affected: 3.3.30 and older
Fixed in: 3.3.31 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.

NVD CVE-2025-12177 Wordfence advisory Code change (fix)

medium 5.3 CVE-2025-60092 · published 2025-09-26

Information disclosure in Download Manager (3.3.25 and older)

Affected: 3.3.25 and older
Fixed in: 3.3.26
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-60092 Patchstack advisory

medium 4.3 CVE-2025-60093 · published 2025-09-26

Cross-site request forgery (CSRF) in Download Manager (3.3.24 and older)

Affected: 3.3.24 and older
Fixed in: 3.3.25
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.

NVD CVE-2025-60093 Patchstack advisory

medium 6.1 CVE-2025-10146 · published 2025-09-19

Reflected cross-site scripting (XSS) in Download Manager (3.3.23 and older)

Affected: 3.3.23 and older
Fixed in: 3.3.24 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3.3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

NVD CVE-2025-10146 Wordfence advisory Plugin source

medium 5.4 CVE-2025-4367 · published 2025-06-19

Stored cross-site scripting (XSS) in Download Manager (3.3.18 and older)

Affected: 3.3.18 and older
Fixed in: 3.3.19 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-4367 Wordfence advisory Code change (fix)Plugin source

medium 4.8 CVE-2024-8284 · published 2025-05-15

Cross-site scripting (XSS) in Download Manager (older than 3.2.99)

Affected: older than 3.2.99
Fixed in: 3.2.99
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

NVD CVE-2024-8284 WPScan advisory

high 8.8 CVE-2025-3404 · published 2025-04-19

Arbitrary file deletion in Download Manager (3.3.12 and older)

Affected: 3.3.12 and older
Fixed in: 3.3.13 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

NVD CVE-2025-3404 Wordfence advisory Plugin source

Show 41 older records

medium 5.4 CVE-2025-3056 · published 2025-04-18

Stored cross-site scripting (XSS) in Download Manager (3.3.12 and older)

Affected: 3.3.12 and older
Fixed in: 3.3.13 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

NVD CVE-2025-3056 Wordfence advisory Code change (fix)wordpress.org

medium 4.6 CVE-2024-13126 · published 2025-03-16

Security issue in Download Manager (older than 3.3.07)

Affected: older than 3.3.07
Fixed in: 3.3.07
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.

NVD CVE-2024-13126 WPScan advisory

high 8.1 CVE-2025-1785 · published 2025-03-13

Path traversal / file read in Download Manager (3.3.08 and older)

Affected: 3.3.08 and older
Fixed in: 3.3.09 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.

NVD CVE-2025-1785 Wordfence advisory Code change (fix)

medium 6.3 CVE-2024-56217 · published 2024-12-31

Missing authorization check in Download Manager (3.3.03 and older)

Affected: 3.3.03 and older
Fixed in: 3.3.04
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2024-56217 Patchstack advisory

medium 4.8 CVE-2024-10706 · published 2024-12-20

Stored cross-site scripting (XSS) in Download Manager (older than 3.3.03)

Affected: older than 3.3.03
Fixed in: 3.3.03
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

NVD CVE-2024-10706 WPScan advisory

medium 5.3 CVE-2024-11768 · published 2024-12-19

Missing authorization check in Download Manager (3.3.03 and older)

Affected: 3.3.03 and older
Fixed in: 3.3.04 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.

NVD CVE-2024-11768 Wordfence advisory Plugin source

high 7.3 CVE-2024-11740 · published 2024-12-19

Remote code execution in Download Manager (3.3.03 and older)

Affected: 3.3.03 and older
Fixed in: 3.3.04 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

NVD CVE-2024-11740 Wordfence advisory Plugin source

medium 5.4 CVE-2024-8444 · published 2024-10-30

Cross-site scripting (XSS) in Download Manager (older than 3.3.00)

Affected: older than 3.3.00
Fixed in: 3.3.00
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.

NVD CVE-2024-8444 WPScan advisory

medium 5.4 CVE-2024-6208 · published 2024-07-31

Stored cross-site scripting (XSS) in Download Manager (3.2.97 and older)

Affected: 3.2.97 and older
Fixed in: 3.2.98 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-6208 Wordfence advisory Code change (fix)Plugin source

high 7.5 CVE-2024-2098 · published 2024-06-13

Missing authorization check in Download Manager (3.2.89 and older)

Affected: 3.2.89 and older
Fixed in: 3.2.90 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.

NVD CVE-2024-2098 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-1766 · published 2024-06-12

Stored cross-site scripting (XSS) in Download Manager (3.2.86 and older)

Affected: 3.2.86 and older
Fixed in: 3.2.87 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.

NVD CVE-2024-1766 Wordfence advisory Plugin source

medium 5.4 CVE-2024-5266 · published 2024-06-12

Stored cross-site scripting (XSS) in Download Manager (3.2.92 and older)

Affected: 3.2.92 and older
Fixed in: 3.2.93 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes in all versions up to, and including, 3.2.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5266 Wordfence advisory Code change (fix)wordpress.org wpdownloadmanager.com wpdownloadmanager.com wpdownloadmanager.com

medium 5.4 CVE-2024-4001 · published 2024-06-05

Stored cross-site scripting (XSS) in Download Manager (3.2.93 and older)

Affected: 3.2.93 and older
Fixed in: 3.2.94 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4001 Wordfence advisory Code change (fix)

medium 5.4 CVE-2024-4160 · published 2024-05-31

Stored cross-site scripting (XSS) in Download Manager (3.2.90 and older)

Affected: 3.2.90 and older
Fixed in: 3.2.91 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-4160 Wordfence advisory Code change (fix)wordpress.org wpdownloadmanager.com

high 7.5 CVE-2024-32131 · published 2024-05-17

Information disclosure in Download Manager (3.2.82 and older)

Affected: 3.2.82 and older
Fixed in: 3.2.83
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.

NVD CVE-2024-32131 Patchstack advisory

medium 5.4 CVE-2024-29114 · published 2024-03-19

Stored cross-site scripting (XSS) in Download Manager (3.2.84 and older)

Affected: 3.2.84 and older
Fixed in: 3.2.85
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.

NVD CVE-2024-29114 Patchstack advisory

medium 5.4 CVE-2023-6954 · published 2024-03-13

Stored cross-site scripting (XSS) in Download Manager (3.2.85 and older)

Affected: 3.2.85 and older
Fixed in: 3.2.86 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2023-6954 Wordfence advisory Plugin source

medium 5.3 CVE-2023-6785 · published 2024-03-13

Missing authorization check in Download Manager (3.2.84 and older)

Affected: 3.2.84 and older
Fixed in: 3.2.85 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).

NVD CVE-2023-6785 Wordfence advisory Code change (fix)

high 7.5 CVE-2023-6421 · published 2024-01-01

Security issue in Download Manager (older than 3.2.83)

Affected: older than 3.2.83
Fixed in: 3.2.83
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.

NVD CVE-2023-6421 WPScan advisory

medium 5.4 CVE-2023-2305 · published 2023-06-09

Stored cross-site scripting (XSS) in Download Manager (3.2.70 and older)

Affected: 3.2.70 and older
Fixed in: 3.2.71 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2023-2305 Wordfence advisory Code change (fix)Wordfence advisory Plugin source

medium 6.5 CVE-2023-1524 · published 2023-05-30

Security issue in Download Manager (older than 3.2.71)

Affected: older than 3.2.71
Fixed in: 3.2.71
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.

NVD CVE-2023-1524 WPScan advisory

medium 6.1 CVE-2022-45836 · published 2023-04-18

Reflected cross-site scripting (XSS) in Download Manager (3.2.59 and older)

Affected: 3.2.59 and older
Fixed in: 3.2.60
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.

NVD CVE-2022-45836 Patchstack advisory

medium 5.4 CVE-2022-4476 · published 2023-01-16

Stored cross-site scripting (XSS) in Download Manager (older than 3.2.62)

Affected: older than 3.2.62
Fixed in: 3.2.62
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.

NVD CVE-2022-4476 WPScan advisory

medium 4.9 CVE-2022-2926 · published 2022-09-26

Path traversal / file read in Download Manager (older than 3.2.55)

Affected: older than 3.2.55
Fixed in: 3.2.55
Access needed (per CVSS): Needs an admin-level account
Range from: NVD analysis · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory

NVD CVE-2022-2926 WPScan advisory

high 8.8 CVE-2022-2431 · published 2022-09-06

Arbitrary file deletion in Download Manager (3.2.50 to 3.2.50)

Affected: 3.2.50 to 3.2.50
Fixed in: 3.2.51 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.

NVD CVE-2022-2431 Code change (fix)packetstormsecurity.com Wordfence advisory

high 8.8 CVE-2022-2436 · published 2022-09-06

PHP object injection in Download Manager (3.2.49 and older)

Affected: 3.2.49 and older
Fixed in: 3.2.50 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

NVD CVE-2022-2436 Wordfence advisory Code change (fix)Wordfence advisory Plugin source

high 8.8 CVE-2022-36288 · published 2022-08-23

Cross-site request forgery (CSRF) in Download Manager (3.2.48 and older)

Affected: 3.2.48 and older
Fixed in: 3.2.49 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

NVD CVE-2022-36288 Patchstack advisory wordpress.org

medium 5.4 CVE-2022-34658 · published 2022-08-23

Cross-site scripting (XSS) in Download Manager (3.2.48 and older)

Affected: 3.2.48 and older
Fixed in: 3.2.49 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

NVD CVE-2022-34658 Patchstack advisory wordpress.org

high 8.8 CVE-2022-34347 · published 2022-08-22

Cross-site request forgery (CSRF) in Download Manager (3.2.48 and older)

Affected: 3.2.48 and older
Fixed in: 3.2.49 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

NVD CVE-2022-34347 Patchstack advisory wordpress.org

high 7.5 CVE-2022-2362 · published 2022-08-22

Cross-site scripting (XSS) in Download Manager (older than 3.2.50)

Affected: older than 3.2.50
Fixed in: 3.2.50
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions.

NVD CVE-2022-2362 WPScan advisory

medium 5.4 CVE-2022-2101 · published 2022-07-18

Stored cross-site scripting (XSS) in Download Manager (3.2.46 and older)

Affected: 3.2.46 and older
Fixed in: 3.2.47 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.

NVD CVE-2022-2101 Wordfence advisory Code change (fix)medium.com packetstormsecurity.com Wordfence advisory

medium 6.1 CVE-2022-2168 · published 2022-07-17

Reflected cross-site scripting (XSS) in Download Manager (older than 3.2.44)

Affected: older than 3.2.44
Fixed in: 3.2.44
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting

NVD CVE-2022-2168 WPScan advisory

medium 6.1 CVE-2022-1985 · published 2022-06-13

Reflected cross-site scripting (XSS) in Download Manager (3.2.42 and older)

Affected: 3.2.42 and older
Fixed in: 3.2.43 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.

NVD CVE-2022-1985 Wordfence advisory Code change (fix)wordpress.org Wordfence advisory Wordfence advisory

high 7.5 CVE-2022-0828 · published 2022-04-11

Weak randomness in Download Manager (older than 3.2.34)

Affected: older than 3.2.34
Fixed in: 3.2.34
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

NVD CVE-2022-0828 WPScan advisory

high 7.5 CVE-2021-25087 · published 2022-03-07

Information disclosure in Download Manager (older than 3.2.35)

Affected: older than 3.2.35
Fixed in: 3.2.35
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).

NVD CVE-2021-25087 WPScan advisory

high 8.8 CVE-2021-25069 · published 2022-02-21

Reflected cross-site scripting (XSS) in Download Manager (older than 3.2.34)

Affected: older than 3.2.34
Fixed in: 3.2.34
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: NVD analysis · score by NVD

Details from the advisory

The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue

NVD CVE-2021-25069 WPScan advisory Code change (fix)

medium 6.1 CVE-2019-15889 · published 2019-09-03

Cross-site scripting (XSS) in Download Manager (older than 2.9.94)

Affected: older than 2.9.94
Fixed in: 2.9.94
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.

NVD CVE-2019-15889 Code change (fix)wordpress.org packetstormsecurity.com packetstormsecurity.com packetstormsecurity.com wpvulndb.com

medium 6.1 CVE-2017-18032 · published 2018-01-16

Cross-site scripting (XSS) in Download Manager (older than 2.9.52)

Affected: older than 2.9.52
Fixed in: 2.9.52
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.

NVD CVE-2017-18032 wordpress.org security.dxw.com

medium 6.1 CVE-2017-2216 · published 2017-07-07

Cross-site scripting (XSS) in Download Manager (2.9.49 and older)

Affected: 2.9.49 and older
Fixed in: 2.9.99 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NVD CVE-2017-2216 Code change (fix)wordpress.org jvn.jp

medium 6.1 CVE-2017-2217 · published 2017-07-07

Open redirect in Download Manager (2.9.50 and older)

Affected: 2.9.50 and older
Fixed in: 2.9.99 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

NVD CVE-2017-2217 Code change (fix)wordpress.org jvn.jp

medium 4.3 CVE-2013-7319 · published 2014-02-06

Cross-site scripting (XSS) in Download Manager (2.5.8 and older, 2.5.0 only, 2.5.1 only, 2.5.2 only, 2.5.3 only, 2.5.4 only, 2.5.5 only, 2.5.6 only, 2.5.7 only)

Affected: 2.5.8 and older, 2.5.0 only, 2.5.1 only, 2.5.2 only, 2.5.3 only, 2.5.4 only, 2.5.5 only, 2.5.6 only, 2.5.7 only
Fixed in: 2.5.96 *
Range from: NVD analysis · score by NVD

Details from the advisory

Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.

NVD CVE-2013-7319 wordpress.org secunia.com exploit-db.com nerdbox.it securityfocus.com wpdownloadmanager.com

Recent activity

2026-11-01 — latest release on wordpress.org (3.3.75).
2026-10-21 — Cross-site request forgery (CSRF) disclosed (CVE-2026-86611), fixed in 3.3.71.
2026-10-10 — Reflected cross-site scripting (XSS) disclosed (CVE-2026-12054), fixed in 3.3.58.
2026-10-10 — Stored cross-site scripting (XSS) disclosed (CVE-2026-9696), fixed in 3.3.59.

Free. We check the CVE feeds every day and email you only when a new issue for Download Manager (download-manager) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (38) · Missing authorization (11) · Sensitive data exposure (5) · Cross-site request forgery (CSRF) (4) · Arbitrary file deletion (2) · Path traversal and file read (2) · Privilege escalation (1) · Remote code execution (1) · PHP object injection (1) · Open redirect (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/download-manager (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/download-manager"><img src="https://laskyr.com/plugins/download-manager/badge.svg" alt="Download Manager vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is Download Manager safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (3.3.75)

What to do

Check your version

Known vulnerabilities

Cross-site request forgery (CSRF) in Download Manager (older than 3.3.71, 4.0.0 up to (not including) 7.5.9)

Reflected cross-site scripting (XSS) in Download Manager (3.3.57 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.58 and older)

Information disclosure in Download Manager (3.3.71 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.71 and older)

Missing authorization check in Download Manager (3.3.71 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.70 and older)

Stored cross-site scripting (XSS) in Download Manager (older than 3.3.71)

Missing authorization check in Download Manager (3.3.68 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.66 and older)

Cross-site scripting (XSS) in Download Manager (older than 3.3.66)

Missing authorization check in Download Manager (older than 3.3.62)

Stored cross-site scripting (XSS) in Download Manager (3.3.61 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.60 and older)

Missing authorization check in Download Manager (3.3.51 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.52 and older)

Missing authorization check in Download Manager (3.3.52 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.53 and older)

Missing authorization check in Download Manager (3.3.49 and older)

Reflected cross-site scripting (XSS) in Download Manager (3.3.46 and older)

Privilege escalation in Download Manager (3.3.40 and older)

Missing authorization check in Download Manager (3.3.32 and older)

Information disclosure in Download Manager (3.3.32 and older)

Security issue in Download Manager (3.3.30 and older)

Information disclosure in Download Manager (3.3.25 and older)

Cross-site request forgery (CSRF) in Download Manager (3.3.24 and older)

Reflected cross-site scripting (XSS) in Download Manager (3.3.23 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.18 and older)

Cross-site scripting (XSS) in Download Manager (older than 3.2.99)

Arbitrary file deletion in Download Manager (3.3.12 and older)

Stored cross-site scripting (XSS) in Download Manager (3.3.12 and older)

Security issue in Download Manager (older than 3.3.07)

Path traversal / file read in Download Manager (3.3.08 and older)

Missing authorization check in Download Manager (3.3.03 and older)

Stored cross-site scripting (XSS) in Download Manager (older than 3.3.03)

Missing authorization check in Download Manager (3.3.03 and older)

Remote code execution in Download Manager (3.3.03 and older)

Cross-site scripting (XSS) in Download Manager (older than 3.3.00)

Stored cross-site scripting (XSS) in Download Manager (3.2.97 and older)

Missing authorization check in Download Manager (3.2.89 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.86 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.92 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.93 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.90 and older)

Information disclosure in Download Manager (3.2.82 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.84 and older)

Stored cross-site scripting (XSS) in Download Manager (3.2.85 and older)

Missing authorization check in Download Manager (3.2.84 and older)

Security issue in Download Manager (older than 3.2.83)

Stored cross-site scripting (XSS) in Download Manager (3.2.70 and older)

Security issue in Download Manager (older than 3.2.71)

Reflected cross-site scripting (XSS) in Download Manager (3.2.59 and older)

Stored cross-site scripting (XSS) in Download Manager (older than 3.2.62)

Path traversal / file read in Download Manager (older than 3.2.55)

Arbitrary file deletion in Download Manager (3.2.50 to 3.2.50)

PHP object injection in Download Manager (3.2.49 and older)

Cross-site request forgery (CSRF) in Download Manager (3.2.48 and older)

Cross-site scripting (XSS) in Download Manager (3.2.48 and older)

Cross-site request forgery (CSRF) in Download Manager (3.2.48 and older)

Cross-site scripting (XSS) in Download Manager (older than 3.2.50)

Stored cross-site scripting (XSS) in Download Manager (3.2.46 and older)

Reflected cross-site scripting (XSS) in Download Manager (older than 3.2.44)

Reflected cross-site scripting (XSS) in Download Manager (3.2.42 and older)

Weak randomness in Download Manager (older than 3.2.34)

Information disclosure in Download Manager (older than 3.2.35)

Reflected cross-site scripting (XSS) in Download Manager (older than 3.2.34)

Cross-site scripting (XSS) in Download Manager (older than 2.9.94)

Cross-site scripting (XSS) in Download Manager (older than 2.9.52)

Cross-site scripting (XSS) in Download Manager (2.9.49 and older)

Open redirect in Download Manager (2.9.50 and older)

Cross-site scripting (XSS) in Download Manager (2.5.8 and older, 2.5.0 only, 2.5.1 only, 2.5.2 only, 2.5.3 only, 2.5.4 only, 2.5.5 only, 2.5.6 only, 2.5.7 only)

Recent activity

Get an email when Download Manager has a new vulnerability

Browse vulnerabilities

Where this data comes from