Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Download Manager - Security Vulnerability (CVE-2026-119156)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have "Anyone can register" enabled, the plugin's [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the…
PLUGIN
Download Manager
CVE-2026-119156
Risk Score
Threat Entry
Updated 2026-10-11
Download Manager - Security Vulnerability (CVE-2026-12054)
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
PLUGIN
Download Manager
CVE-2026-12054
Risk Score
Threat Entry
Updated 2026-10-11
Download Manager - Security Vulnerability (CVE-2026-9696)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Download Manager
CVE-2026-9696
Risk Score
Threat Entry
Updated 2026-10-10
Download Manager - Security Vulnerability (CVE-2026-103964)
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside…
PLUGIN
Download Manager
CVE-2026-103964
Risk Score
Threat Entry
Updated 2026-10-11
Download Manager - Security Vulnerability (CVE-2026-102401)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different…
PLUGIN
Download Manager
CVE-2026-102401
Risk Score
Threat Entry
Updated 2026-10-02
Download Manager - Security Vulnerability (CVE-2026-94405)
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
PLUGIN
Download Manager
CVE-2026-94405
Risk Score
Threat Entry
Updated 2026-10-03
Download Manager - Security Vulnerability (CVE-2026-97338)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to…
PLUGIN
Download Manager
CVE-2026-97338
Risk Score
Threat Entry
Updated 2026-10-01
Download Manager - Security Vulnerability (CVE-2026-86610)
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
PLUGIN
Download Manager
CVE-2026-86610
Risk Score
Threat Entry
Updated 2026-09-28
Download Manager - Security Vulnerability (CVE-2026-86609)
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
PLUGIN
Download Manager
CVE-2026-86609
Risk Score
Threat Entry
Updated 2026-09-18
Download Manager - Security Vulnerability (CVE-2026-92714)
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references,…
PLUGIN
Download Manager
CVE-2026-92714
Risk Score
Threat Entry
Updated 2026-08-12
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-16685)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
PLUGIN
Download Manager
CVE-2026-16685
Risk Score
Threat Entry
Updated 2026-08-26
Download Manager - Security Vulnerability (CVE-2026-14292)
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
PLUGIN
Download Manager
CVE-2026-14292
Risk Score
Threat Entry
Updated 2026-07-27
Download Manager - Security Vulnerability (CVE-2026-14235)
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
PLUGIN
Download Manager
CVE-2026-14235
Risk Score
Threat Entry
Updated 2026-07-09
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-14343)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however,…
PLUGIN
Download Manager
CVE-2026-14343
Risk Score
Threat Entry
Updated 2026-07-01
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-13733)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can…
PLUGIN
Download Manager
CVE-2026-13733
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Broken Access Control (CVE-2026-4057)
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do…
PLUGIN
Download Manager
CVE-2026-4057
Risk Score
Threat Entry
Updated 2026-07-24
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-5357)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdm_members' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts…
PLUGIN
Download Manager
CVE-2026-5357
Risk Score
Threat Entry
Updated 2026-07-20
Download Manager - Broken Access Control (CVE-2026-39676)
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2026-39676
Risk Score
Threat Entry
Updated 2026-07-24
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-39615)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2026-39615
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Information Disclosure (CVE-2026-2571)
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
PLUGIN
Download Manager
CVE-2026-2571
Risk Score