WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
download-manager
Published
2024-12-19
Title
Download Manager < 3.3.04 - Missing Authorization
Slug
download-manager
Published
2025-02-23
Title
Download Manager < 3.3.07 - Unauthenticated Data Exposure
Slug
download-manager
Published
2025-03-12
Title
Download Manager < 3.3.09 - Authenticated (Author+) Path Traversal to Limited File Overwrite
Slug
download-manager
Published
2025-04-17
Title
Download Manager < 3.3.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
download-manager
Published
2025-04-18
Title
Download Manager < 3.3.13 - Author+ Arbitrary File Deletion
Slug
download-manager
Published
2025-06-18
Title
Download Manager < 3.3.19 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
Slug
download-manager
Published
2025-09-18
Title
Download Manager < 3.3.24 - Reflected Cross-Site Scripting via `user_ids` Parameter
Slug
download-manager
Published
2025-09-26
Title
Download Manager < 3.3.25 - Cross-Site Request Forgery
Slug
download-manager
Published
2025-09-26
Title
Download Manager < 3.3.26 - Unauthenticated Sensitive Information Exposure
Slug
download-manager
Published
2025-11-07
Title
Download Manager < 3.3.31 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
Slug
download-manager
Published
2025-09-30
Title
Download Manager < 3.3.33 - Authenticated (Subscriber+) Information Exposure
Slug
download-manager
Published
2025-12-17
Title
Download Manager < 3.3.33 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
Slug
download-manager
Published
2026-01-05
Title
Download Manager < 3.3.41 - Unauthenticated Limited Privilege Escalation
Slug
download-manager
Published
2026-02-17
Title
Download Manager < 3.3.47 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Slug
download-manager
Published
2026-03-18
Title
Download Manager < 3.3.50 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Slug
download-manager
Published
2026-02-10
Title
Download Manager < 3.3.54 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
download-manager
Published
2026-04-08
Title
Download Manager < 3.3.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
download-manager
Published
2026-04-09
Title
Download Manager < 3.3.52 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
Slug
download-manager
Published
2026-02-19
Title
Download Manager < 3.3.53 - Missing Authorization
Slug
download-manager
Published
2026-06-30
Title
Download Manager < 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Slug
download-manager
Published
2026-07-06
Title
WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
Slug
download-manager
Published
2026-07-08
Title
Download Manager < 3.3.62 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Slug
download-manager
Published
2026-07-20
Title
WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
Slug
download-manager
Published
2026-07-31
Title
Download Manager < 3.3.67 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Slug
download-media
Published
2024-02-26
Title
Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media