WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
download-manager
Published
2026-10-09
Title
Download Manager < 3.3.58 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Slug
download-manager
Published
2026-09-17
Title
Download Manager < 3.3.69 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Slug
download-manager
Published
2026-09-25
Title
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
Slug
download-manager
Published
2026-09-29
Title
Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
Slug
download-manager
Published
2026-10-01
Title
Download Manager < 3.3.71 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Slug
download-manager
Published
2026-10-09
Title
Download Manager < 3.3.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Slug
download-manager
Published
2026-10-09
Title
Download Manager < 3.3.72 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Slug
download-manager
Published
2026-10-19
Title
Download Manager (Free & Pro) - Privacy Settings Update via CSRF
Slug
download-manager
Published
2026-10-19
Title
Download Manager (Free & Pro) - Privacy Settings Update via CSRF
Slug
download-media
Published
2024-02-26
Title
Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media
Slug
download-media-library
Published
2025-12-31
Title
Download Media Library <= 0.2.1 - Unauthenticated Sensitive Information Exposure
Slug
download-monitor
Published
2015-03-08
Title
Download Monitor < 1.6.4 - Authenticated Directory Listing
Slug
download-monitor
Published
2015-04-20
Title
Download Monitor < 1.7.1 - Reflected Cross-Site Scripting (XSS)
Slug
download-monitor
Published
2017-05-05
Title
Download Monitor < 1.9.7 - Unauthenticated Downloading of Logs
Slug
download-monitor
Published
2013-07-23
Title
Download Monitor < 3.3.6.2 - Multiple Reflected Cross-Site Scripting
Slug
download-monitor
Published
2021-10-20
Title
Download Monitor < 4.4.5 - Admin+ SQL Injection
Slug
download-monitor
Published
2022-01-14
Title
Download Monitor < 4.4.7 - Reflected Cross-Site Scripting
Slug
download-monitor
Published
2021-10-29
Title
Download Monitor < 4.4.7 - Admin+ Arbitrary File Download
Slug
download-monitor
Published
2021-10-29
Title
Download Monitor < 4.4.7 - Admin+ Stored Cross-Site Scripting
Slug
download-monitor
Published
2022-04-05
Title
Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
Slug
download-monitor
Published
2022-09-19
Title
Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
Slug
download-monitor
Published
2023-05-30
Title
Download Monitor < 4.8.2 - Admin+ SSRF
Slug
download-monitor
Published
2024-01-08
Title
Download Monitor < 4.9.5 - Authenticated (Admin+) SQL Injection
Slug
download-monitor
Published
2024-05-29
Title
Download Monitor < 4.9.14 - Missing Authorization
Slug
download-monitor
Published
2024-09-25
Title
Download Monitor < 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Shop Enable