Download Manager

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Download Manager

Information

Software Type Plugin
Software Slug download-manager (view on wordpress.org)
Software Status Active
Software Author codename065
Software Website www.wpdownloadmanager.com
Software Downloads 11,564,145
Software Active Installs 100,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 88 Vulnerabilities

Submit a Vulnerability
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
6.1
CVE-2026-12054
Oct 9, 2026
Researcher: Yuvraj Tomar
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
6.4
CVE-2026-9696
Oct 9, 2026
Researcher: theviper17y
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
4.3
CVE-2026-103964
Oct 9, 2026
Researcher: Sawyer
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
6.4
CVE-2026-102401
Oct 9, 2026
Researcher: Wordfence PRISM
Download Manager <= 3.3.70 - Unauthenticated Information Exposure
5.3
CVE-2026-94405
Oct 2, 2026
Researcher: Ananda Dhakal
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
6.4
CVE-2026-97338
Oct 1, 2026
Researcher: daroo
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
6.5
CVE-2026-92714
Sep 17, 2026
Researcher: pb>sec
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-14292
Aug 5, 2026
Researcher: Yaswanth Reddy Sunkara
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
6.4
CVE-2026-16685
Jul 31, 2026
Researcher: Wordfence PRISM
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
6.4
CVE-2026-14343
Jul 8, 2026
Researcher: Wordfence PRISM
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
6.4
CVE-2026-13733
Jun 30, 2026
Researcher: Wordfence PRISM
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
4.3
CVE-2026-4057
Apr 9, 2026
Researcher: Or Benit
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-5357
Apr 8, 2026
Researcher: zaim
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
4.3
CVE-2026-2571
Mar 18, 2026
Researcher: Quốc Huy (jtwings)
Download Manager <= 3.3.52 - Missing Authorization
5.3
CVE-2026-39676
Feb 19, 2026
Researcher: Steven Julian
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
6.1
CVE-2026-1666
Feb 17, 2026
Researcher: Jack Taylor
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-39615
Feb 10, 2026
Researcher: hhhai
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
7.3
CVE-2025-15364
Jan 5, 2026
Researcher: Drew Webber (mcdruid)
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
4.3
CVE-2025-13498
Dec 17, 2025
Researcher: type5afe
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
5.3
CVE-2025-12177
Nov 7, 2025
Researcher: AlexHenry
Title Status CVE ID CVSS Researchers Date
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter Patched CVE-2026-12054 6.1 Yuvraj Tomar October 9, 2026
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode Patched CVE-2026-9696 6.4 theviper17y October 9, 2026
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email Patched CVE-2026-103964 4.3 Sawyer October 9, 2026
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute Patched CVE-2026-102401 6.4 Wordfence PRISM October 9, 2026
Download Manager <= 3.3.70 - Unauthenticated Information Exposure Patched CVE-2026-94405 5.3 Ananda Dhakal October 2, 2026
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name Patched CVE-2026-97338 6.4 daroo October 1, 2026
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter Patched CVE-2026-92714 6.5 pb>sec September 17, 2026
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-14292 7.2 Yaswanth Reddy Sunkara August 5, 2026
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute Patched CVE-2026-16685 6.4 Wordfence PRISM July 31, 2026
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes Patched CVE-2026-14343 6.4 Wordfence PRISM July 8, 2026
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute Patched CVE-2026-13733 6.4 Wordfence PRISM June 30, 2026
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal Patched CVE-2026-4057 4.3 Or Benit April 9, 2026
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Patched CVE-2026-5357 6.4 zaim April 8, 2026
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter Patched CVE-2026-2571 4.3 Quốc Huy (jtwings) March 18, 2026
Download Manager <= 3.3.52 - Missing Authorization Patched CVE-2026-39676 5.3 Steven Julian February 19, 2026
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter Patched CVE-2026-1666 6.1 Jack Taylor February 17, 2026
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2026-39615 6.4 hhhai February 10, 2026
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword Patched CVE-2025-15364 7.3 Drew Webber (mcdruid) January 5, 2026
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure Patched CVE-2025-13498 4.3 type5afe December 17, 2025
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key Patched CVE-2025-12177 5.3 AlexHenry November 7, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation