Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2026-1666)
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Download Manager
CVE-2026-1666
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Privilege Escalation (CVE-2025-15364)
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.
PLUGIN
Download Manager
CVE-2025-15364
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Broken Access Control (CVE-2025-13498)
The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.
PLUGIN
Download Manager
CVE-2025-13498
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Information Disclosure (CVE-2025-63070)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2025-63070
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Security Vulnerability (CVE-2025-12177)
The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.
PLUGIN
Download Manager
CVE-2025-12177
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Information Disclosure (CVE-2025-60092)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2025-60092
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Request Forgery (CSRF) (CVE-2025-60093)
Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2025-60093
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2025-10146)
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3.3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Download Manager
CVE-2025-10146
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2025-4367)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Download Manager
CVE-2025-4367
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2024-8284)
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Download Manager
CVE-2024-8284
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Remote Code Execution (CVE-2025-3404)
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Download Manager
CVE-2025-3404
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2025-3056)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Download Manager
CVE-2025-3056
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Security Vulnerability (CVE-2024-13126)
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
PLUGIN
Download Manager
CVE-2024-13126
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Path Traversal (CVE-2025-1785)
The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.
PLUGIN
Download Manager
CVE-2025-1785
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Broken Access Control (CVE-2024-56217)
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through
PLUGIN
Download Manager
CVE-2024-56217
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2024-10706)
The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Download Manager
CVE-2024-10706
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Security Vulnerability (CVE-2024-11768)
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
PLUGIN
Download Manager
CVE-2024-11768
Risk Score
Threat Entry
Updated 2026-06-17
The Download Manager - Security Vulnerability (CVE-2024-11740)
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The Download Manager
CVE-2024-11740
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2024-8444)
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
PLUGIN
Download Manager
CVE-2024-8444
Risk Score
Threat Entry
Updated 2026-06-17
Download Manager - Cross-Site Scripting (XSS) (CVE-2024-6208)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Download Manager
CVE-2024-6208
Risk Score