WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
download-attachments
Published
2025-06-19
Title
Download Attachments < 1.3.2 - Unauthenticated Insecure Direct Object Reference
Slug
download-button-for-elementor
Published
2024-07-11
Title
Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
download-counter
Published
2025-08-04
Title
Download Counter < 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter
Slug
download-counter
Published
2025-06-22
Title
Download Counter <= 1.4 - Unauthenticated Arbitrary File Read
Slug
download-counter-button
Published
2025-10-15
Title
Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download
Slug
download-from-files
Published
2021-09-13
Title
Download from files <= 1.48 - Unauthenticated Arbitrary File Upload
Slug
download-html-tinymce-button
Published
2025-01-02
Title
Download HTML TinyMCE Button <= 1.2 - Reflected XSS
Slug
download-info-page
Published
2023-02-15
Title
Download Info Page <= 1.3.9 - Admin+ Stored XSS
Slug
download-magnet
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
download-manager
Published
2014-08-01
Title
Download Manager <= 2.5.8 - Download Package file Parameter Stored XSS
Slug
download-manager
Published
2014-08-01
Title
Download Manager <= 2.2.2 - admin.php cid Parameter XSS
Slug
download-manager
Published
2014-12-03
Title
Download Manager <= 2.7.4 - Code Execution / Remote File Inclusion
Slug
download-manager
Published
2014-11-24
Title
Download Manager <= 2.7.2 - Privilege Escalation
Slug
download-manager
Published
2015-07-16
Title
Download Manager <= 2.7.94 - Authenticated Stored XSS
Slug
download-manager
Published
2016-01-19
Title
Download Manager <= 2.8.7 - Multiple Vulnerabilities
Slug
download-manager
Published
2017-03-01
Title
Download Manager <= 2.9.45 - Cross-Site Request Forgery (CSRF)
Slug
download-manager
Published
2017-06-16
Title
Download Manager <= 2.9.51 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
download-manager
Published
2017-07-13
Title
Download Manager <= 2.9.49 - Cross-Site Scripting (XSS)
Slug
download-manager
Published
2017-07-13
Title
Download Manager <= 2.9.50 - Open Redirect
Slug
download-manager
Published
2018-01-09
Title
Download Manager <= 2.9.60 - Cross-Site Request Forgery (CSRF)
Slug
download-manager
Published
2019-04-17
Title
Download Manager <= 2.9.93 - Authenticated Cross-Site Scripting (XSS)
Slug
download-manager
Published
2019-06-09
Title
Download Manager <= 2.9.96 - Various Sanitisation Issues
Slug
download-manager
Published
2021-04-17
Title
WordPress Download Manager < 3.1.18 - Unauthorised Download Duplication
Slug
download-manager
Published
2021-04-30
Title
Download Manager < 3.1.23 - Unauthorised Asset Manager Usage
Slug
download-manager
Published
2021-04-30
Title
Download Manager < 3.1.22 - Plugin Settings Change via CSRF