Plugin icon

CM Download Manager – Organize, Protect & Share Files in WordPress

cm-download-manager

Vulnerabilities:

10

Last Updated:

March 14, 2026

Active Installs:

100

Published
Title
Fixed in
CVSS
Published
2025-03-27
Title
CM Download Manager < 3.0.0 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 3.0.0
CVSS
9.1 (critical)
Published
2024-03-04
Title
CM Download and File Manager < 2.9.1 - Download Edit via CSRF
Fixed in
Fixed in 2.9.1
CVSS
5.4 (medium)
Published
2024-03-04
Title
CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF
Fixed in
Fixed in 2.9.0
CVSS
5.4 (medium)
Published
2024-03-04
Title
CM Download Manager < 2.9.0 - Download Deletion via CSRF
Fixed in
Fixed in 2.9.0
CVSS
5.4 (medium)
Published
2022-09-05
Title
CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
Fixed in
Fixed in 2.8.6
CVSS
5.9 (medium)
Published
2021-04-13
Title
CM Download Manager < 2.8.0 - Unauthenticated Reflected Cross Site Scripting (XSS)
Fixed in
Fixed in 2.8.0
CVSS
6.1 (medium)
Published
2021-04-13
Title
CM Download Manager < 2.8.0 - Authenticated Arbitrary File Deletion
Fixed in
Fixed in 2.8.0
CVSS
5.4 (medium)
Published
2020-10-22
Title
CM Download Manager < 2.8.0 - Authenticated Cross-Site Scripting
Fixed in
Fixed in 2.8.0
CVSS
5.4 (medium)
Published
2015-01-16
Title
CM Download Manager < 2.0.7 - CSRF to Cross-Site Scripting
Fixed in
Fixed in 2.0.7
CVSS
8.2 (high)
Published
2014-11-20
Title
CM Download Manager < 2.0.4 - Unauthenticated Code Injection
Fixed in
Fixed in 2.0.4
CVSS
10.0 (critical)