EN ES
Start free
Menu

Download Manager: known security problems

91 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 91 known security problems on this page. Each one has a fixed version. Updating to version 7.5.9 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.3.70; from 4.0.0 up to and including 7.5.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.70
  • From 4.0.0 up to and including 7.5.8
Fixed in
3.3.71, 7.5.9
What to do
If your site has an affected version, update Download Manager to version 7.5.9 or newer.
Official ID
CVE-2026-86611
Report title
Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.3.57)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.57
Fixed in
3.3.58
What to do
If your site has an affected version, update Download Manager to version 3.3.58 or newer.
Official ID
CVE-2026-12054
Report title
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.58)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.58
Fixed in
3.3.59
What to do
If your site has an affected version, update Download Manager to version 3.3.59 or newer.
Official ID
CVE-2026-9696
Report title
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
First reported
Sources
This week

Anyone with an account on your site, even a basic one could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.71
Fixed in
3.3.72
What to do
If your site has an affected version, update Download Manager to version 3.3.72 or newer.
Official ID
CVE-2026-103964
Report title
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.71)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.71
Fixed in
3.3.72
What to do
If your site has an affected version, update Download Manager to version 3.3.72 or newer.
Official ID
CVE-2026-102401
Report title
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.3.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.70
Fixed in
3.3.71
What to do
If your site has an affected version, update Download Manager to version 3.3.71 or newer.
Official ID
CVE-2026-94405
Report title
Download Manager <= 3.3.70 - Unauthenticated Information Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.3.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.70
Fixed in
3.3.71
What to do
If your site has an affected version, update Download Manager to version 3.3.71 or newer.
Official ID
CVE-2026-97338
Report title
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.3.68)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.68
Fixed in
3.3.69
What to do
If your site has an affected version, update Download Manager to version 3.3.69 or newer.
Official ID
CVE-2026-92714
Report title
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (before 3.3.66)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.3.66
Fixed in
3.3.66
What to do
If your site has an affected version, update Download Manager to version 3.3.66 or newer.
Official ID
CVE-2026-14292
Report title
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.66)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.66
Fixed in
3.3.67
What to do
If your site has an affected version, update Download Manager to version 3.3.67 or newer.
Official ID
CVE-2026-16685
Report title
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.61)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.61
Fixed in
3.3.62
What to do
If your site has an affected version, update Download Manager to version 3.3.62 or newer.
Official ID
CVE-2026-14343
Report title
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.60)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.60
Fixed in
3.3.61
What to do
If your site has an affected version, update Download Manager to version 3.3.61 or newer.
Official ID
CVE-2026-13733
Report title
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
First reported
Sources
This week

Someone with a contributor account on your site could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.51
Fixed in
3.3.52
What to do
If your site has an affected version, update Download Manager to version 3.3.52 or newer.
Official ID
CVE-2026-4057
Report title
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.52)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.52
Fixed in
3.3.53
What to do
If your site has an affected version, update Download Manager to version 3.3.53 or newer.
Official ID
CVE-2026-5357
Report title
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.3.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.49
Fixed in
3.3.50
What to do
If your site has an affected version, update Download Manager to version 3.3.50 or newer.
Official ID
CVE-2026-2571
Report title
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.3.52)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.52
Fixed in
3.3.53
What to do
If your site has an affected version, update Download Manager to version 3.3.53 or newer.
Official ID
CVE-2026-39676
Report title
Download Manager <= 3.3.52 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.46
Fixed in
3.3.47
What to do
If your site has an affected version, update Download Manager to version 3.3.47 or newer.
Official ID
CVE-2026-1666
Report title
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.53)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.53
Fixed in
3.3.54
What to do
If your site has an affected version, update Download Manager to version 3.3.54 or newer.
Official ID
CVE-2026-39615
Report title
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.40
Fixed in
3.3.41
What to do
If your site has an affected version, update Download Manager to version 3.3.41 or newer.
Official ID
CVE-2025-15364
Report title
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.3.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.32
Fixed in
3.3.33
What to do
If your site has an affected version, update Download Manager to version 3.3.33 or newer.
Official ID
CVE-2025-13498
Report title
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.3.30)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.30
Fixed in
3.3.31
What to do
If your site has an affected version, update Download Manager to version 3.3.31 or newer.
Official ID
CVE-2025-12177
Report title
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.32
Fixed in
3.3.33
What to do
If your site has an affected version, update Download Manager to version 3.3.33 or newer.
Official ID
CVE-2025-63070
Report title
Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.25
Fixed in
3.3.26
What to do
If your site has an affected version, update Download Manager to version 3.3.26 or newer.
Official ID
CVE-2025-60092
Report title
Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.3.24)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.24
Fixed in
3.3.25
What to do
If your site has an affected version, update Download Manager to version 3.3.25 or newer.
Official ID
CVE-2025-60093
Report title
Download Manager <= 3.3.24 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.23
Fixed in
3.3.24
What to do
If your site has an affected version, update Download Manager to version 3.3.24 or newer.
Official ID
CVE-2025-10146
Report title
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.18
Fixed in
3.3.19
What to do
If your site has an affected version, update Download Manager to version 3.3.19 or newer.
Official ID
CVE-2025-4367
Report title
Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
First reported
Sources
This week

Someone with an author account on your site could read or delete private files on your server (up to and including 3.3.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.12
Fixed in
3.3.13
What to do
If your site has an affected version, update Download Manager to version 3.3.13 or newer.
Official ID
CVE-2025-3404
Report title
Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.3.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.12
Fixed in
3.3.13
What to do
If your site has an affected version, update Download Manager to version 3.3.13 or newer.
Official ID
CVE-2025-3056
Report title
Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
First reported
Sources
This week

Someone with an author account on your site could read or delete private files on your server (up to and including 3.3.08)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.08
Fixed in
3.3.09
What to do
If your site has an affected version, update Download Manager to version 3.3.09 or newer.
Official ID
CVE-2025-1785
Report title
Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.3.06)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.06
Fixed in
3.3.07
What to do
If your site has an affected version, update Download Manager to version 3.3.07 or newer.
Official ID
CVE-2024-13126
Report title
Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.3.03)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.03
Fixed in
3.3.04
What to do
If your site has an affected version, update Download Manager to version 3.3.04 or newer.
Official ID
CVE-2024-56217
Report title
Download Manager <= 3.3.03 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.3.03)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.03
Fixed in
3.3.04
What to do
If your site has an affected version, update Download Manager to version 3.3.04 or newer.
Official ID
CVE-2024-11740
Report title
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.3.03) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.03
Fixed in
3.3.04
What to do
If your site has an affected version, update Download Manager to version 3.3.04 or newer.
Official ID
CVE-2024-11768
Report title
Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.02)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.02
Fixed in
3.3.03
What to do
If your site has an affected version, update Download Manager to version 3.3.03 or newer.
Official ID
CVE-2024-10706
Report title
Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.99)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.99
Fixed in
3.3.00
What to do
If your site has an affected version, update Download Manager to version 3.3.00 or newer.
Official ID
CVE-2024-8444
Report title
Download Manager <= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.98)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.98
Fixed in
3.2.99
What to do
If your site has an affected version, update Download Manager to version 3.2.99 or newer.
Official ID
CVE-2024-8284
Report title
Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.97)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.97
Fixed in
3.2.98
What to do
If your site has an affected version, update Download Manager to version 3.2.98 or newer.
Official ID
CVE-2024-6208
Report title
Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.2.89)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.89
Fixed in
3.2.90
What to do
If your site has an affected version, update Download Manager to version 3.2.90 or newer.
Official ID
CVE-2024-2098
Report title
Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.92)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.92
Fixed in
3.2.94
What to do
If your site has an affected version, update Download Manager to version 3.2.94 or newer.
Official ID
CVE-2024-5266
Report title
Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.2.86)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.86
Fixed in
3.2.87
What to do
If your site has an affected version, update Download Manager to version 3.2.87 or newer.
Official ID
CVE-2024-1766
Report title
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.93)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.93
Fixed in
3.2.94
What to do
If your site has an affected version, update Download Manager to version 3.2.94 or newer.
Official ID
CVE-2024-4001
Report title
Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.90)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.90
Fixed in
3.2.91
What to do
If your site has an affected version, update Download Manager to version 3.2.91 or newer.
Official ID
CVE-2024-4160
Report title
Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.84)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.84
Fixed in
3.2.85
What to do
If your site has an affected version, update Download Manager to version 3.2.85 or newer.
Official ID
CVE-2024-29114
Report title
Download Manager <= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.85)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.85
Fixed in
3.2.86
What to do
If your site has an affected version, update Download Manager to version 3.2.86 or newer.
Official ID
CVE-2023-6954
Report title
Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.2.84)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.84
Fixed in
3.2.85
What to do
If your site has an affected version, update Download Manager to version 3.2.85 or newer.
Official ID
CVE-2023-6785
Report title
Download Manager <= 3.2.84 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.2.82)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.82
Fixed in
3.2.83
What to do
If your site has an affected version, update Download Manager to version 3.2.83 or newer.
Official ID
CVE-2023-6421
Report title
Download Manager <= 3.2.82 - Unauthenticated Password Leak
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.70
Fixed in
3.2.71
What to do
If your site has an affected version, update Download Manager to version 3.2.71 or newer.
Official ID
CVE-2023-2305
Report title
Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.2.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.70
Fixed in
3.2.71
What to do
If your site has an affected version, update Download Manager to version 3.2.71 or newer.
Official ID
CVE-2023-1524
Report title
Download Manager <= 3.2.70 - Insufficient Authorization to Information Disclosure
First reported
Sources
This week

A stranger could use it to harm your site (from 4.0 up to, but not including, 6.3.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 4.0 up to, but not including, 6.3.0
Fixed in
6.3.0
What to do
If your site has an affected version, update Download Manager to version 6.3.0 or newer.
Official ID
CVE-2023-1809
Report title
Download Manager Pro <= 6.2.9 - Unauthenticated Information Disclosure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.61)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.61
Fixed in
3.2.62
What to do
If your site has an affected version, update Download Manager to version 3.2.62 or newer.
Official ID
CVE-2022-4476
Report title
Download Manager <= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.59)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.59
Fixed in
3.2.60
What to do
If your site has an affected version, update Download Manager to version 3.2.60 or newer.
Official ID
CVE-2022-45836
Report title
Download Manager <= 3.2.59 - Refleced Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.55
Fixed in
3.2.55
What to do
If your site has an affected version, update Download Manager to version 3.2.55 or newer.
Official ID
CVE-2022-2926
Report title
Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site (up to and including 3.2.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.49
Fixed in
3.2.50
What to do
If your site has an affected version, update Download Manager to version 3.2.50 or newer.
Official ID
CVE-2022-2436
Report title
Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.53)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.53
Fixed in
3.2.54
What to do
If your site has an affected version, update Download Manager to version 3.2.54 or newer.
Report title
Download Manager <= 3.2.53 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.2.48)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.48
Fixed in
3.2.49
What to do
If your site has an affected version, update Download Manager to version 3.2.49 or newer.
Official ID
CVE-2022-34347
Report title
Download Manager <= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.2.48) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.48
Fixed in
3.2.49
What to do
If your site has an affected version, update Download Manager to version 3.2.49 or newer.
Official ID
CVE-2022-36288
Report title
Download Manager <= 3.2.48 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.2.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.49
Fixed in
3.2.50
What to do
If your site has an affected version, update Download Manager to version 3.2.50 or newer.
Official ID
CVE-2022-2362
Report title
Download Manager <= 3.2.49 - IP Blocking Bypass
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.50
Fixed in
3.2.51
What to do
If your site has an affected version, update Download Manager to version 3.2.51 or newer.
Official ID
CVE-2022-2431
Report title
Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.2.48)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.48
Fixed in
3.2.49
What to do
If your site has an affected version, update Download Manager to version 3.2.49 or newer.
Official ID
CVE-2022-34658
Report title
Download Manager <= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.43)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.43
Fixed in
3.2.44
What to do
If your site has an affected version, update Download Manager to version 3.2.44 or newer.
Official ID
CVE-2022-2168
Report title
Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.43) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.43
Fixed in
3.2.44
What to do
If your site has an affected version, update Download Manager to version 3.2.44 or newer.
Report title
Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.46
Fixed in
3.2.47
What to do
If your site has an affected version, update Download Manager to version 3.2.47 or newer.
Official ID
CVE-2022-2101
Report title
Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.2.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.42
Fixed in
3.2.43
What to do
If your site has an affected version, update Download Manager to version 3.2.43 or newer.
Official ID
CVE-2022-1985
Report title
Download Manager <= 3.2.42 - Reflected Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (before 3.2.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.39
Fixed in
3.2.39
What to do
If your site has an affected version, update Download Manager to version 3.2.39 or newer.
Official ID
CVE-2022-0828
Report title
Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key
First reported
Sources
This week

Someone could use it to harm your site (before 3.2.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.35
Fixed in
3.2.35
What to do
If your site has an affected version, update Download Manager to version 3.2.35 or newer.
Official ID
CVE-2021-25087
Report title
Download Manager <= 3.2.34 - Sensitive Information Disclosure
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.34
Fixed in
3.2.34
What to do
If your site has an affected version, update Download Manager to version 3.2.34 or newer.
Official ID
CVE-2021-25069
Report title
WordPress Download Manager <= 3.2.33 - Authenticated SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.22
Fixed in
3.2.22
What to do
If your site has an affected version, update Download Manager to version 3.2.22 or newer.
Official ID
CVE-2021-24969
Report title
WordPress Download Manager <= 3.2.21 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.16
Fixed in
3.2.16
What to do
If your site has an affected version, update Download Manager to version 3.2.16 or newer.
Official ID
CVE-2021-24773
Report title
WordPress Download Manager <= 3.2.15 - Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.2.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.13
Fixed in
3.2.13
What to do
If your site has an affected version, update Download Manager to version 3.2.13 or newer.
Report title
WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.1.24)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.24
Fixed in
3.1.25
What to do
If your site has an affected version, update Download Manager to version 3.1.25 or newer.
Official ID
CVE-2021-34639
Report title
WordPress Download Manager <= 3.1.24 - Authenticated File Upload
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.1.24)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.1.24
Fixed in
3.1.25
What to do
If your site has an affected version, update Download Manager to version 3.1.25 or newer.
Official ID
CVE-2021-34638
Report title
WordPress Download Manager <= 3.1.24 - Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.1.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.22
Fixed in
3.1.22
What to do
If your site has an affected version, update Download Manager to version 3.1.22 or newer.
Report title
WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could use it to harm your site (before 3.1.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.23
Fixed in
3.1.23
What to do
If your site has an affected version, update Download Manager to version 3.1.23 or newer.
Report title
WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage
First reported
Sources
This week

Someone could run their own code on your site and take it over (before 3.1.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.19
Fixed in
3.1.19
What to do
If your site has an affected version, update Download Manager to version 3.1.19 or newer.
Report title
WordPress Download Manager < 3.1.19 - Arbitrary File Upload
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 3.1.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.18
Fixed in
3.1.18
What to do
If your site has an affected version, update Download Manager to version 3.1.18 or newer.
Report title
Download Manager <= 3.1.17 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.97)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.97
Fixed in
2.9.97
What to do
If your site has an affected version, update Download Manager to version 2.9.97 or newer.
Report title
WordPress Download Manager <= 2.9.96 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.94)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.94
Fixed in
2.9.94
What to do
If your site has an affected version, update Download Manager to version 2.9.94 or newer.
Official ID
CVE-2019-15889
Report title
WordPress Download Manager <= 2.9.93 - Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.9.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.6
Fixed in
2.9.61
What to do
If your site has an affected version, update Download Manager to version 2.9.61 or newer.
Report title
WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.51
Fixed in
2.9.51
What to do
If your site has an affected version, update Download Manager to version 2.9.51 or newer.
Official ID
CVE-2017-2217
Report title
WordPress Download Manager < 2.9.51 - Open Redirect
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.51)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.51
Fixed in
2.9.52
What to do
If your site has an affected version, update Download Manager to version 2.9.52 or newer.
Official ID
CVE-2017-18032
Report title
WordPress Download Manager <= 2.9.51 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.50)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.50
Fixed in
2.9.50
What to do
If your site has an affected version, update Download Manager to version 2.9.50 or newer.
Official ID
CVE-2017-2216
Report title
WordPress Download Manager <= 2.9.49 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.9.45)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.45
Fixed in
2.9.46
What to do
If your site has an affected version, update Download Manager to version 2.9.46 or newer.
Report title
WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could use it to harm your site (before 2.8.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.8
Fixed in
2.8.8
What to do
If your site has an affected version, update Download Manager to version 2.8.8 or newer.
Report title
Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.8
Fixed in
2.8.8
What to do
If your site has an affected version, update Download Manager to version 2.8.8 or newer.
Report title
Download Manager <= 2.8.7 - Privilege Escalation
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 2.8.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.8
Fixed in
2.8.8
What to do
If your site has an affected version, update Download Manager to version 2.8.8 or newer.
Report title
Download Manager <= 2.8.7 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.7.94)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.94
Fixed in
2.7.95
What to do
If your site has an affected version, update Download Manager to version 2.7.95 or newer.
Report title
WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (before 2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.7.5
Fixed in
2.7.5
What to do
If your site has an affected version, update Download Manager to version 2.7.5 or newer.
Report title
WordPress Download Manager <= 2.7.4 - Remote Code Execution
First reported
Sources
This week

Someone could use it to harm your site (before 2.7.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.7.3
Fixed in
2.7.3
What to do
If your site has an affected version, update Download Manager to version 2.7.3 or newer.
Official ID
CVE-2014-9260
Report title
WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.2
Fixed in
2.2.3
What to do
If your site has an affected version, update Download Manager to version 2.2.3 or newer.
Report title
Download Manager <= 2.2.2 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.5.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.8
Fixed in
2.5.9
What to do
If your site has an affected version, update Download Manager to version 2.5.9 or newer.
Official ID
CVE-2013-7319
Report title
Download Manager < 2.5.9 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.5.8) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.8
Fixed in
2.5.9
What to do
If your site has an affected version, update Download Manager to version 2.5.9 or newer.
Report title
Download Manager <= 2.5.8 - Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)