WordPress plugin · download-manager
Is Download Manager safe?
2 flaws affect the current version.
The newest release on wordpress.org, 3.3.74, is inside the affected range of 2 records, so there may be no fix yet. Check the changelog; if it doesn’t mention the fix, deactivate it until it does.
- Flaws on record
- 74
- High or critical
- 14
- Exploited
- none
- Current version
- 3.3.74
- Last updated
- Oct 26, 2026
- Active installs
- 100,000+
Every recorded flaw
- Oct 10, 2026Download Manager: Reflected Cross-Site ScriptingCVE-2026-12054 · affects up to 3.3.57 · reported by WordfenceMedium 6.1
- Oct 10, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-9696 · affects up to 3.3.58 · reported by WordfenceMedium 6.4
- Oct 10, 2026Download Manager: Sensitive Information ExposureCVE-2026-103964 · affects up to 3.3.71 · reported by WordfenceMedium 4.3
- Oct 10, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-102401 · affects up to 3.3.71 · reported by WordfenceMedium 6.4
- Oct 2, 2026Download Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-94405 · affects up to 3.3.71 · reported by PatchstackMedium 5.3
- Oct 2, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-97338 · affects up to 3.3.70 · reported by WordfenceMedium 6.4
- Oct 1, 2026Download Manager: Does not sufficiently sanitise and escape a package setting before outputting it back in a pageCVE-2026-86610 · fixed in 3.3.71 · reported by WPScanMedium 6.4
- Sep 27, 2026Download Manager: Does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin pageCVE-2026-86609 · fixed in 7.5.6 · reported by WPScanHigh 8.8
- Sep 18, 2026Download Manager: Insecure Direct Object ReferenceCVE-2026-92714 · affects up to 3.3.68 · reported by WordfenceMedium 6.5
- Aug 1, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-16685 · affects up to 3.3.66 · reported by WordfenceMedium 6.4
- Aug 1, 2026Download Manager: Does not properly escape a package's title before outputting it in the front-end package templatesCVE-2026-14292 · fixed in 3.3.66 · reported by WPScanMedium 5.4
- Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · fixed in 3.3.62 · reported by WPScanHigh 7.5
- Jul 9, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-14343 · affects up to 3.3.61 · reported by WordfenceMedium 6.4
- Jul 1, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-13733 · affects up to 3.3.60 · reported by WordfenceMedium 6.4
- Apr 9, 2026Download Manager: Unauthorized modification of dataCVE-2026-4057 · affects up to 3.3.51 · reported by WordfenceMedium 4.3
- Apr 9, 2026Download Manager: Stored Cross-Site ScriptingCVE-2026-5357 · affects up to 3.3.52 · reported by WordfenceMedium 6.4
- Apr 8, 2026Download Manager: Missing AuthorizationCVE-2026-39676 · affects up to 3.3.52 · reported by PatchstackMedium 5.3
- Apr 8, 2026Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39615 · affects up to 3.3.53 · reported by PatchstackMedium 5.9
- Mar 19, 2026Download Manager: Unauthorized access of dataCVE-2026-2571 · affects up to 3.3.49 · reported by WordfenceMedium 4.3
- Feb 18, 2026Download Manager: Reflected Cross-Site ScriptingCVE-2026-1666 · affects up to 3.3.46 · reported by WordfenceMedium 6.1
- Jan 5, 2026Download Manager: Privilege escalationCVE-2025-15364 · affects up to 3.3.40 · reported by WordfenceHigh 7.3
- Dec 18, 2025Download Manager: Unauthorized access of sensitive informationCVE-2025-13498 · affects up to 3.3.32 · reported by WordfenceMedium 4.3
- Dec 9, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63070 · affects up to 3.3.32 · reported by PatchstackMedium 4.3
- Nov 7, 2025Download Manager: Unauthorized accessCVE-2025-12177 · affects up to 3.3.30 · reported by WordfenceMedium 5.3
- Sep 26, 2025Download Manager: Cross-Site Request Forgery (CSRF)CVE-2025-60093 · affects up to 3.3.24 · reported by PatchstackMedium 4.3
- Sep 26, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60092 · affects up to 3.3.25 · reported by PatchstackMedium 5.3
- Sep 19, 2025Download Manager: Reflected Cross-Site ScriptingCVE-2025-10146 · affects up to 3.3.23 · reported by WordfenceMedium 6.1
- Jun 19, 2025Download Manager: Stored Cross-Site ScriptingCVE-2025-4367 · affects up to 3.3.18 · reported by WordfenceMedium 6.4
- May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · fixed in 3.2.99 · reported by WPScanMedium 4.8
- Apr 19, 2025Download Manager: Arbitrary file deletionCVE-2025-3404 · affects up to 3.3.12 · reported by Wordfence1.2% oddsHigh 8.8
- Apr 18, 2025Download Manager: Stored Cross-Site ScriptingCVE-2025-3056 · affects up to 3.3.12 · reported by WordfenceMedium 5.4
- Mar 16, 2025Download Manager: Doesn't prevent directory listing on web servers that don't use htaccessCVE-2024-13126 · fixed in 3.3.07 · reported by WPScanMedium 4.6
- Mar 13, 2025Download Manager: Directory TraversalCVE-2025-1785 · affects up to 3.3.08 · reported by WordfenceMedium 5.4
- Dec 31, 2024Download Manager: Missing AuthorizationCVE-2024-56217 · affects up to 3.3.03 · reported by PatchstackMedium 4.3
- Dec 20, 2024Download Manager: Does not sanitise and escape some of its settingsCVE-2024-10706 · fixed in 3.3.03 · reported by WPScanMedium 4.8
- Dec 19, 2024Download Manager: Unauthorized download of password-protected contentCVE-2024-11768 · affects up to 3.3.03 · reported by WordfenceMedium 5.3
- Dec 19, 2024The Download Manager: Arbitrary shortcode executionCVE-2024-11740 · affects up to 3.3.03 · reported by Wordfence1.9% oddsHigh 7.3
- Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · fixed in 3.3.00 · reported by WPScanMedium 5.4
- Jul 31, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-6208 · affects up to 3.2.97 · reported by WordfenceMedium 6.4
- Jun 13, 2024Download Manager: Unauthorized access of dataCVE-2024-2098 · affects up to 3.2.89 · reported by WordfenceHigh 7.5
- Jun 12, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-1766 · affects up to 3.2.86 · reported by WordfenceMedium 4.4
- Jun 12, 2024Download Manager Pro: Stored Cross-Site ScriptingCVE-2024-5266 · affects up to 3.2.92 · reported by WordfenceMedium 6.4
- Jun 5, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-4001 · affects up to 3.2.93 · reported by WordfenceMedium 6.4
- May 31, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-4160 · affects up to 3.2.90 · reported by WordfenceMedium 6.4
- May 17, 2024Download Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32131 · affects up to 3.2.82 · reported by PatchstackMedium 5.3
- Mar 19, 2024Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29114 · affects up to 3.2.84 · reported by PatchstackMedium 6.5
- Mar 13, 2024Download Manager Pro: Stored Cross-Site ScriptingCVE-2023-6954 · affects up to 3.2.85 · reported by WordfenceMedium 6.4
- Mar 13, 2024Download Manager: Unauthorized file download of files addedCVE-2023-6785 · affects up to 3.2.84 · reported by WordfenceMedium 5.3
- Jan 1, 2024Download Manager: Does not protect file download's passwordsCVE-2023-6421 · fixed in 3.2.83 · reported by WPScan2.4% oddsHigh 7.5
- Jun 9, 2023Download Manager: Stored Cross-Site ScriptingCVE-2023-2305 · affects up to 3.2.70 · reported by WordfenceMedium 6.4
- May 30, 2023Download Manager: Does not adequately validate passwords for password-protected filesCVE-2023-1524 · fixed in 3.2.71 · reported by WPScanMedium 6.5
- May 2, 2023Download Manager: Leaks master key information without the need for a passwordCVE-2023-1809 · fixed in 6.3.0 · reported by WPScanHigh 7.5
- Apr 18, 2023W3 Eden, Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2022-45836 · fixed in 3.2.60 · reported by PatchstackMedium 6.3
- Jan 16, 2023Download Manager: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4476 · fixed in 3.2.62 · reported by WPScanMedium 5.4
- Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · fixed in 3.2.55 · reported by WPScan1.7% oddsMedium 4.9
- Sep 6, 2022Download Manager: Deserialization of untrusted inputCVE-2022-2436 · affects up to 3.2.49 · reported by Wordfence1.8% oddsHigh 8.8
- Sep 6, 2022Download Manager: Arbitrary file deletionCVE-2022-2431 · affects up to 3.2.50 · reported by Wordfence3.8% oddsHigh 8.1
- Aug 23, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-36288 · affects up to 3.2.48 · reported by PatchstackMedium 5.4
- Aug 23, 2022Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-34658 · affects up to 3.2.48 · reported by PatchstackMedium 5.4
- Aug 22, 2022Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-34347 · affects up to 3.2.48 · reported by PatchstackMedium 4.2
- Aug 22, 2022Download Manager: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-2362 · fixed in 3.2.50 · reported by WPScan1.2% oddsHigh 7.5
- Jul 18, 2022Download Manager: Stored Cross-Site ScriptingCVE-2022-2101 · affects up to 3.2.46 · reported by Wordfence1.1% oddsMedium 6.4
- Jul 17, 2022Download Manager: Does not escape a generated URL before outputting it back in an attribute of the history dashboardCVE-2022-2168 · fixed in 3.2.44 · reported by WPScan1.4% oddsMedium 6.1
- Jun 13, 2022Download Manager: Reflected Cross-Site ScriptingCVE-2022-1985 · affects up to 3.2.42 · reported by Wordfence1.2% oddsMedium 6.1
- Apr 11, 2022Download Manager: Uses the uniqid php function to generate the master key for a downloadCVE-2022-0828 · fixed in 3.2.34 · reported by WPScan1.5% oddsHigh 7.5
- Mar 7, 2022Download Manager: Does not have any authorisation checks in some of the REST API endpointsCVE-2021-25087 · fixed in 3.2.35 · reported by WPScan1.5% oddsHigh 7.5
- Feb 21, 2022Download Manager: Does not sanitise and escape the package_ids parameter before using it in a SQL statementCVE-2021-25069 · fixed in 3.2.34 · reported by WPScan1.5% oddsHigh 8.8
- Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · fixed in 3.2.22 · reported by WPScanMedium 5.4
- Nov 1, 2021WordPress Download Manager: Does not escape some of the Download settingsCVE-2021-24773 · fixed in 3.2.16 · reported by WPScan2.9% oddsMedium 4.8
- Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · fixed in 2.9.94 · reported by MITRE11% oddsMedium 6.1
- Jan 16, 2018The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.CVE-2017-18032 · fixed in 2.9.52 · reported by MITREMedium 6.1
- Jul 7, 2017WordPress Download Manager prior to version 2.9.51: Open redirectCVE-2017-2217 · affects up to 2.9.50 · reported by vultures@jpcert.or.jp1.5% oddsMedium 6.1
- Jul 7, 2017WordPress Download Manager prior to version 2.9.50: Cross-site scriptingCVE-2017-2216 · affects up to 2.9.49 · reported by vultures@jpcert.or.jp1.4% oddsMedium 6.1
- Feb 6, 2014Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2013-7319 · fixed in 2.5.9 · reported by MITRE4.6% oddsMedium 4.3
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.