VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Download Manager security & vulnerabilities

download-manager— active installsLast vulnerability Nov 12, 2026

No known unpatched vulnerabilities in the latest version

All 93 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
93Known vulnerabilities
  • Critical2
  • High20
  • Medium71
  • Low0
Vulnerabilities per year
2013: 2 vulnerabilities2132014: 3 vulnerabilities3142015: 1 vulnerability1152016: 3 vulnerabilities3162017: 4 vulnerabilities4172018: 1 vulnerability1182019: 2 vulnerabilities2192021: 9 vulnerabilities9212022: 17 vulnerabilities17222023: 4 vulnerabilities4232024: 15 vulnerabilities15242025: 11 vulnerabilities11252026: 21 vulnerabilities2126

All Download Manager vulnerabilities

Download Manager vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter
6.0.0 – 7.6.3Update to 7.6.4
CVE-2026-120658
High7.2Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
6.0.0 – 7.5.9Update to 7.6.4
CVE-2026-119156
Medium4.3Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
≤7.5.8Update to 3.3.71 or 7.5.9
CVE-2026-86611
Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
≤3.3.57Update to 3.3.58
CVE-2026-12054
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
≤3.3.58Update to 3.3.59
CVE-2026-9696
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
≤3.3.71Update to 3.3.72
CVE-2026-103964
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
≤3.3.71Update to 3.3.72
CVE-2026-102401
Medium5.3Unauthenticated Information Exposure
≤3.3.70Update to 3.3.71
CVE-2026-94405
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
≤3.3.70Update to 3.3.71
CVE-2026-97338
Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
≤3.3.68Update to 3.3.69
CVE-2026-92714
High7.2Unauthenticated Stored Cross-Site Scripting
<3.3.66Update to 3.3.66
CVE-2026-14292
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
≤3.3.66Update to 3.3.67
CVE-2026-16685
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
≤3.3.61Update to 3.3.62
CVE-2026-14343
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
≤3.3.60Update to 3.3.61
CVE-2026-13733
Medium4.3Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
≤3.3.51Update to 3.3.52
CVE-2026-4057
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤3.3.52Update to 3.3.53
CVE-2026-5357
Medium4.3Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
≤3.3.49Update to 3.3.50
CVE-2026-2571
Medium5.3Missing Authorization
≤3.3.52Update to 3.3.53
CVE-2026-39676
Medium6.1Reflected Cross-Site Scripting via 'redirect_to' Parameter
≤3.3.46Update to 3.3.47
CVE-2026-1666
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.3.53Update to 3.3.54
CVE-2026-39615
High7.3Unauthenticated Limited Privilege Escalation via updatePassword
≤3.3.40Update to 3.3.41
CVE-2025-15364
Medium4.3Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
≤3.3.32Update to 3.3.33
CVE-2025-13498
Medium5.3Unauthenticated Cron Trigger due to Hardcoded Cron Key
≤3.3.30Update to 3.3.31
CVE-2025-12177
Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.3.32Update to 3.3.33
CVE-2025-63070
Medium4.3Cross-Site Request Forgery
≤3.3.24Update to 3.3.25
CVE-2025-60093
Medium5.3Unauthenticated Sensitive Information Exposure
≤3.3.25Update to 3.3.26
CVE-2025-60092
Medium6.1Reflected Cross-Site Scripting via `user_ids` Parameter
≤3.3.23Update to 3.3.24
CVE-2025-10146
Medium6.4Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
≤3.3.18Update to 3.3.19
CVE-2025-4367
High8.8Authenticated (Author+) Arbitrary File Deletion
≤3.3.12Update to 3.3.13
CVE-2025-3404
Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤3.3.12Update to 3.3.13
CVE-2025-3056
Medium5.4Authenticated (Author+) Path Traversal to Limited File Overwrite
≤3.3.08Update to 3.3.09
CVE-2025-1785
Medium5.3Unauthenticated Information Disclosure via Unprotected Directory
≤3.3.06Update to 3.3.07
CVE-2024-13126
Medium4.3Missing Authorization
≤3.3.03Update to 3.3.04
CVE-2024-56217
Medium5.3Improper Authorization to Unauthenticated Download of Password-Protected Files
≤3.3.03Update to 3.3.04
CVE-2024-11768
High7.3Unauthenticated Arbitrary Shortcode Execution
≤3.3.03Update to 3.3.04
CVE-2024-11740
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.3.02Update to 3.3.03
CVE-2024-10706
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.99Update to 3.3.00
CVE-2024-8444
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.2.98Update to 3.2.99
CVE-2024-8284
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.2.97Update to 3.2.98
CVE-2024-6208
High7.5Improper Authorization via protectMediaLibrary
≤3.2.89Update to 3.2.90
CVE-2024-2098
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
≤3.2.92Update to 3.2.94
CVE-2024-5266
Medium4.4Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
≤3.2.86Update to 3.2.87
CVE-2024-1766
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
≤3.2.93Update to 3.2.94
CVE-2024-4001
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
≤3.2.90Update to 3.2.91
CVE-2024-4160
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.84Update to 3.2.85
CVE-2024-29114
Medium5.3Missing Authorization
≤3.2.84Update to 3.2.85
CVE-2023-6785
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.2.85Update to 3.2.86
CVE-2023-6954
Medium5.3Unauthenticated Password Leak
≤3.2.82Update to 3.2.83
CVE-2023-6421
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.2.70Update to 3.2.71
CVE-2023-2305
Medium4.3Insufficient Authorization to Information Disclosure
≤3.2.70Update to 3.2.71
CVE-2023-1524
Medium5.3Unauthenticated Information Disclosure
4.0 – <6.3.0Update to 6.3.0
CVE-2023-1809
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.61Update to 3.2.62
CVE-2022-4476
Medium6.1Refleced Cross-Site Scripting
≤3.2.59Update to 3.2.60
CVE-2022-45836
Medium4.9Authenticated (Admin+) Path Traversal
<3.2.55Update to 3.2.55
CVE-2022-2926
High8.8Authenticated (Contributor+) PHAR Deserialization
≤3.2.49Update to 3.2.50
CVE-2022-2436
Medium6.1Reflected Cross-Site Scripting
≤3.2.53Update to 3.2.54
—
High8.8Cross-Site Request Forgery to Plugin Settings Update
≤3.2.48Update to 3.2.49
CVE-2022-34347
High8.8Cross-Site Request Forgery
≤3.2.48Update to 3.2.49
CVE-2022-36288
Medium5.3IP Blocking Bypass
≤3.2.49Update to 3.2.50
CVE-2022-2362
High8.8Authenticated (Contributor+) Arbitrary File Deletion
≤3.2.50Update to 3.2.51
CVE-2022-2431
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.48Update to 3.2.49
CVE-2022-34658
Medium6.1Reflected Cross-Site Scripting
≤3.2.43Update to 3.2.44
CVE-2022-2168
Medium6.1Reflected Cross-Site Scripting
≤3.2.43Update to 3.2.44
—
Medium6.4Contributor+ Cross-Site Scripting
≤3.2.46Update to 3.2.47
CVE-2022-2101
Medium6.1Reflected Cross-Site Scripting
≤3.2.42Update to 3.2.43
CVE-2022-1985
High7.5Unauthenticated Brute Force of File Master Key
<3.2.39Update to 3.2.39
CVE-2022-0828
High7.5Sensitive Information Disclosure
<3.2.35Update to 3.2.35
CVE-2021-25087
High8.8Authenticated SQL Injection
<3.2.34Update to 3.2.34
CVE-2021-25069
Medium6.4Cross-Site Scripting
<3.2.22Update to 3.2.22
CVE-2021-24969
Medium5.5Cross-Site Scripting
<3.2.16Update to 3.2.16
CVE-2021-24773
High7.1Cross-Site Request Forgery
<3.2.13Update to 3.2.13
—
High7.5Authenticated File Upload
≤3.1.24Update to 3.1.25
CVE-2021-34639
Medium6.5Cross-Site Scripting
≤3.1.24Update to 3.1.25
CVE-2021-34638
High8.8Arbitrary File Upload
<3.1.19Update to 3.1.19
—
High8.8Cross-Site Request Forgery
<3.1.22Update to 3.1.22
—
Medium6.3 Arbitrary Asset Manager Usage
<3.1.23Update to 3.1.23
—
Medium5.3Missing Authorization
<3.1.18Update to 3.1.18
—
Medium6.1Cross-Site Scripting
<2.9.97Update to 2.9.97
—
Medium6.1Cross-Site Scripting
<2.9.94Update to 2.9.94
CVE-2019-15889
Medium6.3Cross-Site Request Forgery
≤2.9.6Update to 2.9.61
—
Medium6.1Open Redirect
<2.9.51Update to 2.9.51
CVE-2017-2217
Medium6.1Cross-Site Scripting
≤2.9.51Update to 2.9.52
CVE-2017-18032
Medium6.1Reflected Cross-Site Scripting
<2.9.50Update to 2.9.50
CVE-2017-2216
High8.8Cross-Site Request Forgery
≤2.9.45Update to 2.9.46
—
Medium6.5Privilege Escalation
<2.8.8Update to 2.8.8
—
Critical9.1Missing Authorization
<2.8.8Update to 2.8.8
—
Medium5.3Sensitive Information Disclosure via Directory Listing
<2.8.8Update to 2.8.8
—
Medium6.4Stored Cross-Site Scripting
≤2.7.94Update to 2.7.95
—
Critical9.8Remote Code Execution
<2.7.5Update to 2.7.5
—
High8.1Authenticated Arbitrary Options Update
<2.7.3Update to 2.7.3
CVE-2014-9260
Medium6.1Cross-Site Scripting
≤2.2.2Update to 2.2.3
—
High7.2Stored Cross-Site Scripting
≤2.5.8Update to 2.5.9
CVE-2013-7319
Medium5.3Cross-Site Scripting
≤2.5.8Update to 2.5.9
—

Download Manager: common questions

Does Download Manager have known vulnerabilities?

Yes. VulnCrest Radar lists 93 known vulnerabilities in Download Manager: 2 critical, 20 high, 71 medium. None are known to affect version null.

How do I check which version of Download Manager I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Download Manager vulnerability?

CVE-2026-120658, published Nov 12, 2026: Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter. Severity: Medium (CVSS 6.4).

Is any Download Manager vulnerability listed in CISA KEV?

No. None of the known Download Manager vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?