Skip to contentCodename065 Download Manager vulnerabilities
- codename065 download managerDownload Manager (Free & Pro) - Unauthenticated Missing Authorization via Password ValidationCVE-2026-1109493.7 Low
- codename065 download managerDownload Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download KeyCVE-2026-1109483.7 Low
- codename065 download managerDownload Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]CVE-2026-1191567.2 High
- codename065 download managerDownload Manager (Free & Pro) - Privacy Settings Update via CSRFCVE-2026-866114.3 Medium
- codename065 download managerDownload Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' ParameterCVE-2026-120546.1 Medium
- codename065 download managerDownload Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages ShortcodeCVE-2026-96966.4 Medium
- codename065 download managerDownload Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension EmailCVE-2026-1039644.3 Medium
- codename065 download managerDownload Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode AttributeCVE-2026-1024016.4 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerabilityCVE-2026-944055.3 Medium
- codename065 download managerDownload Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display NameCVE-2026-973386.4 Medium
- codename065 download managerDownload Manager < 3.3.71 - Author+ Stored XSS via Package IconCVE-2026-866106.4 Medium
- codename065 download managerDownload Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock SubscriptionCVE-2026-866098.8 High
- codename065 download managerDownload Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' ParameterCVE-2026-927146.5 Medium
- codename065 download managerDownload Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode AttributeCVE-2026-166856.4 Medium
- codename065 download managerWordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package TitleCVE-2026-142925.4 Medium
- codename065 download managerWordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download KeyCVE-2026-142357.5 High
- codename065 download managerDownload Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode AttributesCVE-2026-143436.4 Medium
- codename065 download managerDownload Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode AttributeCVE-2026-137336.4 Medium
- codename065 download managerDownload Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection RemovalCVE-2026-40574.3 Medium
- codename065 download managerDownload Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesCVE-2026-53576.4 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerabilityCVE-2026-39676Public exploit5.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-396155.9 Medium
- codename065 download managerDownload Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' ParameterCVE-2026-25714.3 Medium
- codename065 download managerDownload Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' ParameterCVE-2026-16666.1 Medium
- codename065 download managerDownload Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePasswordCVE-2025-153647.3 High
- codename065 download managerDownload Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password DisclosureCVE-2025-134984.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerabilityCVE-2025-630704.3 Medium
- codename065 download managerDownload Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron KeyCVE-2025-121775.3 Medium
- codename065 download managerWordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-600934.3 Medium
- codename065 download managerWordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure VulnerabilityCVE-2025-600925.3 Medium
- codename065 download managerDownload Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` ParameterCVE-2025-101466.1 Medium
- codename065 download managerDownload Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard ShortcodeCVE-2025-43676.4 Medium
- codename065 download managerDownload Manager <= 3.2.98 - Admin+ Stored XSSCVE-2024-82844.8 Medium
- codename065 download managerDownload Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File DeletionCVE-2025-34048.8 High
- codename065 download managerDownload Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadCVE-2025-30565.4 Medium
- codename065 download managerDownload Manager < 3.3.07 - Unauthenticated Data ExposureCVE-2024-131264.6 Medium
- codename065 download managerDownload Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File OverwriteCVE-2025-17855.4 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerabilityCVE-2024-562174.3 Medium
- codename065 download managerDownload Manager < 3.3.03 - Admin+ Stored XSSCVE-2024-107064.8 Medium
- codename065 download managerDownload manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected FilesCVE-2024-117685.3 Medium
- codename065 download managerDownload Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2024-117407.3 High
- codename065 download managerDownload Manager < 3.3.00 - Contributor+ Stored XSSCVE-2024-84445.4 Medium
- codename065 download managerDownload Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-62086.4 Medium
- codename065 download managerDownload Manager <= 3.2.89 - Improper Authorization via protectMediaLibraryCVE-2024-20987.5 High
- codename065 download managerDownload Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingCVE-2024-17664.4 Medium
- codename065 download managerDownload Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple ShortcodesCVE-2024-52666.4 Medium
- codename065 download managerDownload Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form ShortcodeCVE-2024-40016.4 Medium
- codename065 download managerDownload Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages ShortcodeCVE-2024-41606.4 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerabilityCVE-2024-321315.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.2.84 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-291146.5 Medium
- Show olderLoading…