Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Medium
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting
High
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Medium
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Medium
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Medium
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
Medium
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Medium
Download Manager <= 3.3.52 - Missing Authorization
Medium
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Medium
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
High
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
Medium
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
Medium
Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure
Medium
Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure
Medium
Download Manager <= 3.3.24 - Cross-Site Request Forgery
Medium
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
Medium
Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
Medium
Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion
High
Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite
Medium
Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory
Medium
Download Manager <= 3.3.03 - Missing Authorization
Medium
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
High
Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
Medium
Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
High
Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
Medium
Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
Medium
Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
Medium
Download Manager <= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
Download Manager <= 3.2.84 - Missing Authorization
Medium
Download Manager <= 3.2.82 - Unauthenticated Password Leak
Medium
Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
Download Manager <= 3.2.70 - Insufficient Authorization to Information Disclosure
Medium
Download Manager Pro <= 6.2.9 - Unauthenticated Information Disclosure
Medium
Download Manager <= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.59 - Refleced Cross-Site Scripting
Medium
Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal
Medium
Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
High
Download Manager <= 3.2.53 - Reflected Cross-Site Scripting
Medium
August 4, 2022
Patched in ["3.2.54"]
Download Manager <= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update
High
Download Manager <= 3.2.48 - Cross-Site Request Forgery
High
Download Manager <= 3.2.49 - IP Blocking Bypass
Medium
Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion
High
Download Manager <= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
Medium
Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
Medium
June 23, 2022
Patched in ["3.2.44"]
Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting
Medium
Download Manager <= 3.2.42 - Reflected Cross-Site Scripting
Medium
Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key
High
Download Manager <= 3.2.34 - Sensitive Information Disclosure
High
WordPress Download Manager <= 3.2.33 - Authenticated SQL Injection
High
WordPress Download Manager <= 3.2.21 - Cross-Site Scripting
Medium
WordPress Download Manager <= 3.2.15 - Cross-Site Scripting
Medium
WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery
High
August 9, 2021
Patched in ["3.2.13"]
WordPress Download Manager <= 3.1.24 - Authenticated File Upload
High
WordPress Download Manager <= 3.1.24 - Cross-Site Scripting
Medium
WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery
High
April 30, 2021
Patched in ["3.1.22"]
WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage
Medium
April 30, 2021
Patched in ["3.1.23"]
WordPress Download Manager < 3.1.19 - Arbitrary File Upload
High
April 30, 2021
Patched in ["3.1.19"]
Download Manager <= 3.1.17 - Missing Authorization
Medium
April 16, 2021
Patched in ["3.1.18"]
WordPress Download Manager <= 2.9.96 - Cross-Site Scripting
Medium
June 16, 2019
Patched in ["2.9.97"]
WordPress Download Manager <= 2.9.93 - Cross-Site Scripting
Medium
WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery
Medium
January 9, 2018
Patched in ["2.9.61"]
WordPress Download Manager < 2.9.51 - Open Redirect
Medium
WordPress Download Manager <= 2.9.51 - Cross-Site Scripting
Medium
WordPress Download Manager <= 2.9.49 - Reflected Cross-Site Scripting
Medium
WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery
High
March 1, 2017
Patched in ["2.9.46"]
Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing
Medium
January 19, 2016
Patched in ["2.8.8"]
Download Manager <= 2.8.7 - Privilege Escalation
Medium
January 19, 2016
Patched in ["2.8.8"]
Download Manager <= 2.8.7 - Missing Authorization
Critical
January 19, 2016
Patched in ["2.8.8"]
WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting
Medium
July 16, 2015
Patched in ["2.7.95"]
WordPress Download Manager <= 2.7.4 - Remote Code Execution
Critical
December 15, 2014
Patched in ["2.7.5"]
WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update
High
Download Manager <= 2.2.2 - Cross-Site Scripting
Medium
August 1, 2014
Patched in ["2.2.3"]
Download Manager < 2.5.9 - Stored Cross-Site Scripting
High
Download Manager <= 2.5.8 - Cross-Site Scripting
Medium
December 7, 2013
Patched in ["2.5.9"]