Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · cm-download-manager
CM Download Manager
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Apr 1, 2025CM Download Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30910 · affects up to 2.9.6 · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through <= 2.9.6.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · fixed in 2.9.1 · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · fixed in 2.9.0 · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · fixed in 2.9.0 · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
Sep 26, 2022CM Download Manager: Allows high privilege users suchCVE-2022-3076 · fixed in 2.8.6 · reported by WPScanHigh 7.2
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
Jul 7, 2021Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibCVE-2020-24146 · affects 2.7.0 to 2.7.0 · reported by MITREHigh 8.1
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Jul 7, 2021Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitCVE-2020-24145 · affects 2.7.0 to 2.7.0 · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
Oct 21, 2020The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.CVE-2020-27344 · fixed in 2.8.0 · reported by MITREMedium 6.1
The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.