Download Manager vulnerabilities

Known security issues in the Download Manager WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: download-manager
Latest version: 3.3.73
Active installs: 100,000+
Known vulnerabilities: 119
Data updated: 2026-10-17 09:24 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 7.5.6 (1)

Download Manager: Fixed in version 7.5.6
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager Pro <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting CVE-2026-86609 · Source	Not rated	-	< 7.5.6	2026-07-06

Fixed in version 3.3.72 (2)

Download Manager: Fixed in version 3.3.72
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute CVE-2026-102401 · Source	Medium	6.4	< 3.3.72	2026-10-09
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email CVE-2026-103964 · Source	Medium	4.3	< 3.3.72	2026-10-09

Fixed in version 3.3.71 (3)

Download Manager: Fixed in version 3.3.71
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name CVE-2026-97338 · Source	Medium	6.4	< 3.3.71	2026-09-17
Download Manager <= 3.3.70 - Unauthenticated Information Exposure CVE-2026-94405 · Source	Medium	5.3	< 3.3.71	2026-10-02
[en] The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Sc CVE-2026-86610 · Source	Not rated	-	< 3.3.71	2026-10-01

Fixed in version 3.3.69 (1)

Download Manager: Fixed in version 3.3.69
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter CVE-2026-92714 · Source	Medium	6.5	< 3.3.69	2026-08-05

Fixed in version 3.3.67 (1)

Download Manager: Fixed in version 3.3.67
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute CVE-2026-16685 · Source	Medium	6.4	< 3.3.67	2026-07-08

Fixed in version 3.3.66 (1)

Download Manager: Fixed in version 3.3.66
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting CVE-2026-14292 · Source	Not rated	-	< 3.3.66	2026-08-01

Fixed in version 3.3.62 (1)

Download Manager: Fixed in version 3.3.62
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes CVE-2026-14343 · Source	Medium	6.4	< 3.3.62	2026-06-30

Fixed in version 3.3.61 (1)

Download Manager: Fixed in version 3.3.61
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute CVE-2026-13733 · Source	Medium	6.4	< 3.3.61	2026-06-30

Fixed in version 3.3.59 (1)

Download Manager: Fixed in version 3.3.59
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode CVE-2026-9696 · Source	Medium	6.4	< 3.3.59	2026-10-09

Fixed in version 3.3.58 (1)

Download Manager: Fixed in version 3.3.58
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter CVE-2026-12054 · Source	Medium	6.1	< 3.3.58	2026-10-09

Fixed in version 3.3.54 (1)

Download Manager: Fixed in version 3.3.54
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-39615 · Source	Medium	5.9	< 3.3.54	2026-02-10

Fixed in version 3.3.53 (2)

Download Manager: Fixed in version 3.3.53
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.52 - Missing Authorization CVE-2026-39676 · Source	Medium	5.3	< 3.3.53	2026-02-19
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-5357 · Source	Not rated	-	< 3.3.53	0000-00-00

Fixed in version 3.3.52 (1)

Download Manager: Fixed in version 3.3.52
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal CVE-2026-4057 · Source	Not rated	-	< 3.3.52	0000-00-00

Fixed in version 3.3.50 (1)

Download Manager: Fixed in version 3.3.50
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter CVE-2026-2571 · Source	Not rated	-	< 3.3.50	0000-00-00

Fixed in version 3.3.47 (1)

Download Manager: Fixed in version 3.3.47
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter CVE-2026-1666 · Source	Not rated	-	< 3.3.47	0000-00-00

Fixed in version 3.3.41 (1)

Download Manager: Fixed in version 3.3.41
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword CVE-2025-15364 · Source	High	7.3	< 3.3.41	2026-01-05

Fixed in version 3.3.33 (2)

Download Manager: Fixed in version 3.3.33
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure CVE-2025-13498 · Source	Medium	4.3	< 3.3.33	2025-12-17
Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure CVE-2025-63070 · Source	Medium	4.3	< 3.3.33	2025-09-30

Fixed in version 3.3.31 (1)

Download Manager: Fixed in version 3.3.31
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key CVE-2025-12177 · Source	Medium	5.3	< 3.3.31	2025-11-07

Fixed in version 3.3.26 (1)

Download Manager: Fixed in version 3.3.26
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure CVE-2025-60092 · Source	Low	0.0	< 3.3.26	2025-09-26

Fixed in version 3.3.25 (1)

Download Manager: Fixed in version 3.3.25
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.24 - Cross-Site Request Forgery CVE-2025-60093 · Source	Low	0.0	< 3.3.25	2025-09-26

Fixed in version 3.3.24 (1)

Download Manager: Fixed in version 3.3.24
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter CVE-2025-10146 · Source	Not rated	-	< 3.3.24	0000-00-00

Fixed in version 3.3.19 (1)

Download Manager: Fixed in version 3.3.19
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode CVE-2025-4367 · Source	Medium	5.4	< 3.3.19	0000-00-00

Fixed in version 3.3.13 (2)

Download Manager: Fixed in version 3.3.13
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion CVE-2025-3404 · Source	High	8.8	< 3.3.13	0000-00-00
Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2025-3056 · Source	Medium	5.4	< 3.3.13	0000-00-00

Fixed in version 3.3.09 (1)

Download Manager: Fixed in version 3.3.09
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite CVE-2025-1785 · Source	High	8.1	< 3.3.09	0000-00-00

Fixed in version 3.3.07 (1)

Download Manager: Fixed in version 3.3.07
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory CVE-2024-13126 · Source	Medium	4.6	< 3.3.07	2025-01-17

Fixed in version 3.3.04 (3)

Download Manager: Fixed in version 3.3.04
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11740 · Source	High	7.3	< 3.3.04	2024-12-18
Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files CVE-2024-11768 · Source	Medium	5.3	< 3.3.04	2024-12-18
Download Manager <= 3.3.03 - Missing Authorization CVE-2024-56217 · Source	Medium	4.3	< 3.3.04	2024-12-19

Fixed in version 3.3.03 (1)

Download Manager: Fixed in version 3.3.03
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-10706 · Source	Medium	4.8	< 3.3.03	2024-11-29

Fixed in version 3.3.00 (1)

Download Manager: Fixed in version 3.3.00
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin < 3.3.00 is vulnerable to Cross Site Scripting (XSS) CVE-2024-8444 · Source	Medium	5.4	< 3.3.00	2024-10-09

Fixed in version 3.2.99 (1)

Download Manager: Fixed in version 3.2.99
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.98 - Admin+ Stored XSS CVE-2024-8284 · Source	Medium	4.8	< 3.2.99	0000-00-00

Fixed in version 3.2.98 (1)

Download Manager: Fixed in version 3.2.98
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-6208 · Source	Medium	5.4	< 3.2.98	2024-07-30

Fixed in version 3.2.94 (2)

Download Manager: Fixed in version 3.2.94
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes CVE-2024-5266 · Source	Medium	5.4	< 3.2.94	2024-06-11
Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode CVE-2024-4001 · Source	Medium	5.4	< 3.2.94	2024-06-04

Fixed in version 3.2.91 (1)

Download Manager: Fixed in version 3.2.91
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 3.2.90 is vulnerable to Cross Site Scripting (XSS) CVE-2024-4160 · Source	Medium	5.4	< 3.2.91	2024-05-30

Fixed in version 3.2.90 (1)

Download Manager: Fixed in version 3.2.90
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 3.2.89 is vulnerable to Broken Access Control CVE-2024-2098 · Source	High	7.5	< 3.2.90	2024-06-12

Fixed in version 3.2.87 (1)

Download Manager: Fixed in version 3.2.87
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting CVE-2024-1766 · Source	Medium	5.4	< 3.2.87	2024-06-11

Fixed in version 3.2.86 (1)

Download Manager: Fixed in version 3.2.86
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-6954 · Source	Medium	5.4	< 3.2.86	2024-02-28

Fixed in version 3.2.85 (2)

Download Manager: Fixed in version 3.2.85
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 3.2.84 is vulnerable to Cross Site Scripting (XSS) CVE-2024-29114 · Source	Medium	6.5	< 3.2.85	2024-03-16
Download Manager <= 3.2.84 - Missing Authorization CVE-2023-6785 · Source	Medium	5.3	< 3.2.85	2024-02-28

Fixed in version 3.2.83 (2)

Download Manager: Fixed in version 3.2.83
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 3.2.82 is vulnerable to Bypass Vulnerability CVE-2024-32131 · Source	High	7.5	< 3.2.83	2024-04-12
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak CVE-2023-6421 · Source	High	7.5	< 3.2.83	2023-11-29

Fixed in version 3.2.71 (3)

Download Manager: Fixed in version 3.2.71
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 3.2.49 - Authenticated PHAR Deserialization vulnerability CVE-2022-2436 · Source	High	8.8	< 3.2.71	2022-08-17
WordPress Download Manager Plugin < 3.2.71 is vulnerable to Broken Access Control CVE-2023-1524 · Source	Medium	6.5	< 3.2.71	2023-05-08
Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-2305 · Source	Medium	5.4	< 3.2.71	2023-05-12

Fixed in version 3.2.62 (1)

Download Manager: Fixed in version 3.2.62
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin < 3.2.62 is vulnerable to Cross Site Scripting (XSS) CVE-2022-4476 · Source	Medium	5.4	< 3.2.62	2022-12-20

Fixed in version 3.2.60 (2)

Download Manager: Fixed in version 3.2.60
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.59 - Refleced Cross-Site Scripting CVE-2022-45836 · Source	High	7.1	< 3.2.60	2022-11-29
WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 3.2.60	-

Fixed in version 3.2.55 (1)

Download Manager: Fixed in version 3.2.55
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal CVE-2022-2926 · Source	Medium	4.9	< 3.2.55	2022-09-05

Fixed in version 3.2.54 (1)

Download Manager: Fixed in version 3.2.54
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.53 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.2.54	2022-08-04

Fixed in version 3.2.53 (1)

Download Manager: Fixed in version 3.2.53
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager < 3.2.53 - Unauthenticated Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.2.53	-

Fixed in version 3.2.51 (1)

Download Manager: Fixed in version 3.2.51
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion CVE-2022-2431 · Source	High	8.8	< 3.2.51	2022-07-27

Fixed in version 3.2.50 (1)

Download Manager: Fixed in version 3.2.50
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.49 - Bypass IP Address Blocking Restriction vulnerability CVE-2022-2362 · Source	High	7.5	< 3.2.50	2022-08-01

Fixed in version 3.2.49 (3)

Download Manager: Fixed in version 3.2.49
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities CVE-2022-36288 · Source	Medium	5.4	< 3.2.49	2022-08-02
WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities CVE-2022-34658 · Source	Medium	5.4	< 3.2.49	2022-07-06
WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2022-34347 · Source	Medium	4.2	< 3.2.49	2022-08-02

Fixed in version 3.2.47 (1)

Download Manager: Fixed in version 3.2.47
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.45 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-2101 · Source	Medium	5.4	< 3.2.47	2022-06-21

Fixed in version 3.2.44 (4)

Download Manager: Fixed in version 3.2.44
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.43 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2022-2168 · Source	Medium	6.1	< 3.2.44	2022-06-27
WordPress Download Manager plugin <= 3.2.43 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.2.44	2022-06-27
Download Manager <= 3.2.43 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.2.44	2022-06-23
Download Manager < 3.2.44 - Unauthenticated Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.2.44	-

Fixed in version 3.2.43 (1)

Download Manager: Fixed in version 3.2.43
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.42 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2022-1985 · Source	Medium	6.1	< 3.2.43	2022-06-02

Fixed in version 3.2.39 (1)

Download Manager: Fixed in version 3.2.39
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.38 - Unauthenticated Brute Force of Files Master Key vulnerability CVE-2022-0828 · Source	High	7.5	< 3.2.39	2022-03-16

Fixed in version 3.2.34 (1)

Download Manager: Fixed in version 3.2.34
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.33 - Authenticated SQL injection (SQLi) vulnerability to Reflected XSS vulnerability CVE-2021-25069 · Source	High	8.8	< 3.2.34	2022-01-12

Fixed in version 3.2.25 (1)

Download Manager: Fixed in version 3.2.25
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.24 - Sensitive Information Disclosure vulnerability CVE-2021-25087 · Source	High	7.5	< 3.2.25	2022-02-02

Fixed in version 3.2.22 (1)

Download Manager: Fixed in version 3.2.22
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.21 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24969 · Source	Medium	5.4	< 3.2.22	2021-11-29

Fixed in version 3.2.16 (1)

Download Manager: Fixed in version 3.2.16
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WordPress Download Manager plugin <= 3.2.15 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24773 · Source	Medium	4.8	< 3.2.16	2021-09-29

Fixed in version 3.2.13 (3)

Download Manager: Fixed in version 3.2.13
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 3.2.12 - Email Template Setting Update via Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 3.2.13	2021-08-09
WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 3.2.13	2021-08-09
WordPress Download Manager < 3.2.13 - Email Template Setting Update via CSRF No CVE assigned · Source	Not rated	-	< 3.2.13	-

Fixed in version 3.1.25 (2)

Download Manager: Fixed in version 3.1.25
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WordPress Download Manager plugin <= 3.1.24 - Authenticated Directory Traversal vulnerability CVE-2021-34639 · Source	High	8.8	< 3.1.25	2021-07-29
WordPress Download Manager < 3.1.25 - Authenticated Directory Traversal CVE-2021-34638 · Source	Medium	6.5	< 3.1.25	2021-07-29

Fixed in version 3.1.23 (2)

Download Manager: Fixed in version 3.1.23
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage No CVE assigned · Source	Not rated	-	< 3.1.23	2021-04-30
Download Manager < 3.1.23 - Unauthorised Asset Manager Usage No CVE assigned · Source	Not rated	-	< 3.1.23	-

Fixed in version 3.1.22 (2)

Download Manager: Fixed in version 3.1.22
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 3.1.22	2021-04-30
Download Manager < 3.1.22 - Plugin Settings Change via CSRF No CVE assigned · Source	Not rated	-	< 3.1.22	-

Fixed in version 3.1.19 (2)

Download Manager: Fixed in version 3.1.19
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager < 3.1.19 - Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 3.1.19	2021-04-30
Download Manager < 3.1.19 - Authenticated (author+) PHP4 File Upload to RCE No CVE assigned · Source	Not rated	-	< 3.1.19	-

Fixed in version 3.1.18 (1)

Download Manager: Fixed in version 3.1.18
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager < 3.1.18 - Unauthorised Download Duplication No CVE assigned · Source	Not rated	-	< 3.1.18	-

Fixed in version 3.1.17 (1)

Download Manager: Fixed in version 3.1.17
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 3.1.17 - Missing Authorization No CVE assigned · Source	Not rated	-	< 3.1.17	2021-04-16

Fixed in version 2.9.97 (3)

Download Manager: Fixed in version 2.9.97
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 2.9.96 - Multiple vulnerabilities No CVE assigned · Source	Not rated	-	< 2.9.97	2019-06-16
WordPress Download Manager <= 2.9.96 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.97	2019-06-16
Download Manager <= 2.9.96 - Various Sanitisation Issues No CVE assigned · Source	Not rated	-	< 2.9.97	-

Fixed in version 2.9.94 (2)

Download Manager: Fixed in version 2.9.94
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 2.9.93 - Authenticated Cross-Site Scripting (XSS) CVE-2019-15889 · Source	Medium	6.1	< 2.9.94	2019-04-13
WordPress Download Manager plugin <= 2.9.93 - Authenticated Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 2.9.94	2019-04-23

Fixed in version 2.9.61 (3)

Download Manager: Fixed in version 2.9.61
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <=2.9.60 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 2.9.61	2018-01-10
WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.9.61	2018-01-09
Download Manager <= 2.9.60 - Cross-Site Request Forgery (CSRF) No CVE assigned · Source	Not rated	-	< 2.9.61	-

Fixed in version 2.9.52 (1)

Download Manager: Fixed in version 2.9.52
Vulnerability	Severity	CVSS	Affected versions	Published
Download Manager <= 2.9.51 - Authenticated Reflected Cross-Site Scripting (XSS) CVE-2017-18032 · Source	Medium	6.1	< 2.9.52	2017-06-16

Fixed in version 2.9.51 (1)

Download Manager: Fixed in version 2.9.51
Vulnerability	Severity	CVSS	Affected versions	Published
Open redirect vulnerability in WordPress plugin "WordPress Download Manager" CVE-2017-2217 · Source	Medium	6.1	< 2.9.51	2017-06-13

Fixed in version 2.9.50 (1)

Download Manager: Fixed in version 2.9.50
Vulnerability	Severity	CVSS	Affected versions	Published
Cross-site scripting vulnerability in WordPress plugin "WordPress Download Manager" CVE-2017-2216 · Source	Medium	6.1	< 2.9.50	2017-06-13

Fixed in version 2.9.46 (3)

Download Manager: Fixed in version 2.9.46
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager plugin <= 2.8.97 - Authenticated Arbitrary File Upload Vulnerability No CVE assigned · Source	Not rated	-	< 2.9.46	2017-06-27
WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.9.46	2017-03-01
Download Manager <= 2.9.45 - Cross-Site Request Forgery (CSRF) No CVE assigned · Source	Not rated	-	< 2.9.46	-

Fixed in version 2.8.8 (5)

Download Manager: Fixed in version 2.8.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 2.8.7 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 2.8.8	2016-01-19
Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing No CVE assigned · Source	Not rated	-	< 2.8.8	2016-01-19
Download Manager <= 2.8.7 - Privilege Escalation No CVE assigned · Source	Not rated	-	< 2.8.8	2016-01-19
Download Manager <= 2.8.7 - Missing Authorization No CVE assigned · Source	Not rated	-	< 2.8.8	2016-01-19
Download Manager <= 2.8.7 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 2.8.8	-

Fixed in version 2.7.95 (4)

Download Manager: Fixed in version 2.7.95
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 2.7.94 - Stored XSS No CVE assigned · Source	Not rated	-	< 2.7.95	2015-12-20
WordPress Download Manager Free 2.7.94 & Pro 4 - Authenticated Stored XSS No CVE assigned · Source	Not rated	-	< 2.7.95	2015-07-16
WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.7.95	2015-07-16
Download Manager <= 2.7.94 - Authenticated Stored XSS No CVE assigned · Source	Not rated	-	< 2.7.95	-

Fixed in version 2.7.5 (2)

Download Manager: Fixed in version 2.7.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager <= 2.7.4 - Remote Code Execution No CVE assigned · Source	Not rated	-	< 2.7.5	2014-12-15
Download Manager <= 2.7.4 - Code Execution / Remote File Inclusion No CVE assigned · Source	Not rated	-	< 2.7.5	-

Fixed in version 2.7.3 (1)

Download Manager: Fixed in version 2.7.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin 2.7.2 - Privilege Escalation CVE-2014-9260 · Source	High	8.8	< 2.7.3	2014-11-24

Fixed in version 2.7 (1)

Download Manager: Fixed in version 2.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin - Arbitrary File Download CVE-2014-8585 · Source	Low	0.0	< 2.7	2014-11-04

Fixed in version 2.5.9 (2)

Download Manager: Fixed in version 2.5.9
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Free & Pro Plugin 2.5.8 - Persistent Cross Site Scripting CVE-2013-7319 · Source	Low	0.0	< 2.5.9	2013-12-08
Download Manager <= 2.5.8 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.5.9	2013-12-07

Fixed in version 2.2.3 (3)

Download Manager: Fixed in version 2.2.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager Plugin <= 2.2.2 - XSS No CVE assigned · Source	Not rated	-	< 2.2.3	2015-05-15
Download Manager <= 2.2.2 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.2.3	2014-08-01
Download Manager <= 2.2.2 - admin.php cid Parameter XSS No CVE assigned · Source	Not rated	-	< 2.2.3	-

Affects version 2.7.4 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Download Manager: Affects version 2.7.4 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Download Manager 2.7.4 - Remote Code Execution No CVE assigned · Source	Not rated	-	>= 2.7.0 and <= 2.7.4	2014-12-15

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.