Download Manager

Güvenlik açıkları

• CVE-2022-36288kimlik doğrulamasız · tıklama gerekir≤ 3.2.48

  WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

  Yüksek 8.8

• CVE-2022-34347kimlik doğrulamasız · tıklama gerekir≤ 3.2.48

  WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability

  Yüksek 8.8

• CVE-2025-3404yazar+≤ 3.3.12

  Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion

  Yüksek 8.8

• CVE-2022-2436katılımcı+≤ 3.2.49

  Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization

  Yüksek 8.8

• CVE-2022-2431katılımcı+≤ 3.2.50

  Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion

  Yüksek 8.8

• CVE-2025-1785yazar+≤ 3.3.08

  Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite

  Yüksek 8.1

• CVE-2024-2098kimlik doğrulamasız≤ 3.2.89

  Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

  Yüksek 7.5

• CVE-2024-32131kimlik doğrulamasız≤ 3.2.82

  WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability

  Yüksek 7.5

• CVE-2025-15364kimlik doğrulamasız≤ 3.3.40

  Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword

  Yüksek 7.3

• CVE-2024-11740kimlik doğrulamasız≤ 3.3.03

  Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution

  Yüksek 7.3

• CVE-2026-92714katılımcı+≤ 3.3.68

  Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

  Orta 6.5

• CVE-2026-97338abone+≤ 3.3.70

  Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

  Orta 6.4

• CVE-2026-16685katılımcı+≤ 3.3.66

  Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute

  Orta 6.4

• CVE-2026-14343katılımcı+≤ 3.3.61

  Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes

  Orta 6.4

• CVE-2026-13733katılımcı+≤ 3.3.60

  Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute

  Orta 6.4

• CVE-2026-5357katılımcı+≤ 3.3.52

  Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  Orta 6.4

• CVE-2024-56217giriş gerekir≤ 3.3.03

  WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability

  Orta 6.3

• CVE-2026-1666kimlik doğrulamasız · tıklama gerekir≤ 3.3.46

  Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter

  Orta 6.1

• CVE-2025-10146kimlik doğrulamasız · tıklama gerekir≤ 3.3.23

  Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter

  Orta 6.1

• CVE-2022-45836kimlik doğrulamasız · tıklama gerekir≤ 3.2.59

  WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)

  Orta 6.1

• CVE-2022-1985kimlik doğrulamasız · tıklama gerekir≤ 3.2.42

  Download Manager <= 3.2.42 - Reflected Cross-Site Scripting

  Orta 6.1

• CVE-2019-15889kimlik doğrulamasız · tıklama gerekir

  The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search

  Orta 6.1

• CVE-2017-18032kimlik doğrulamasız · tıklama gerekir

  The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-aj

  Orta 6.1

• CVE-2017-2217kimlik doğrulamasız · tıklama gerekir

  Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web

  Orta 6.1

• CVE-2017-2216kimlik doğrulamasız · tıklama gerekir

  Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web scr

  Orta 6.1

• CVE-2026-39615yüksek yetki≤ 3.3.53

  WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability

  Orta 5.9

• CVE-2024-1766abone+≤ 3.2.86

  Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting

  Orta 5.4

• CVE-2024-29114giriş gerekir≤ 3.2.84

  WordPress Download Manager plugin <= 3.2.84 - Cross Site Scripting (XSS) vulnerability

  Orta 5.4

• CVE-2025-4367yazar+≤ 3.3.18

  Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode

  Orta 5.4

• CVE-2025-3056yazar+≤ 3.3.12

  Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

  Orta 5.4

• CVE-2024-6208katılımcı+≤ 3.2.97

  Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2024-5266yazar+≤ 3.2.92

  Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes

  Orta 5.4

• CVE-2024-4160katılımcı+≤ 3.2.90

  Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode

  Orta 5.4

• CVE-2023-6954katılımcı+≤ 3.2.85

  Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2023-2305katılımcı+≤ 3.2.70

  Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 5.4

• CVE-2022-34658katılımcı+≤ 3.2.48

  WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

  Orta 5.4

• CVE-2022-2101katılımcı+≤ 3.2.46

  Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting

  Orta 5.4

• CVE-2026-94405kimlik doğrulamasız≤ 3.3.71

  WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

  Orta 5.3

• CVE-2026-39676kimlik doğrulamasız≤ 3.3.52

  WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2025-12177kimlik doğrulamasız≤ 3.3.30

  Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key

  Orta 5.3

• CVE-2025-60092kimlik doğrulamasız≤ 3.3.25

  WordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure Vulnerability

  Orta 5.3

• CVE-2024-11768kimlik doğrulamasız≤ 3.3.03

  Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files

  Orta 5.3

• CVE-2023-6785kimlik doğrulamasız≤ 3.2.84

  Download Manager <= 3.2.84 - Missing Authorization

  Orta 5.3

• CVE-2025-60093kimlik doğrulamasız · tıklama gerekir≤ 3.3.24

  WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability

  Orta 4.3

• CVE-2026-2571abone+≤ 3.3.49

  Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter

  Orta 4.3

• CVE-2025-13498abone+≤ 3.3.32

  Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure

  Orta 4.3

• CVE-2025-63070giriş gerekir≤ 3.3.32

  WordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerability

  Orta 4.3

• CVE-2026-4057katılımcı+≤ 3.3.51

  Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal

  Orta 4.3

• CVE-2013-7319

  Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitra

  Orta 4.3