CVE-2026-92714: Authorization Bypass Through User-Controlled Key

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2025-13498: Missing Authorization

The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the wpdmmediaaccess AJAX action. This makes it possible for authenticated attackers,...

PT-2025-11160

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to and including 3.3.08 Description: The issue allows authenticated attackers with Author-level access or higher to overwrite certain file types outside the original directory via the wpdm...

PT-2024-17223

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.3.03 Description The issue is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it...

PT-2024-37452

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.2.97 Description: The issue is related to Stored Cross-Site Scripting in the Download Manager plugin for WordPress. This occurs via the plugin's 'wpdm all packages'...

PT-2024-18821

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.89 Description The issue arises from an improper authorization check on the protectMediaLibrary function, allowing unauthenticated attackers to access password-protected...

PT-2024-28759

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.93 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpdm modal login form shortcode. This allows...

PT-2024-29456

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.90 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpdm-all-packages shortcode. This allows...

PT-2023-18827

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.70 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'wpdm members', 'wpdm login form', 'wpdm reg...

CVE-2022-2431: External Control of File Name or Path

The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles function found in the /Admin/Menu/Packages.php file that triggers upon download post deletion...

CVE-2022-1985

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the /src/Package/views/shortcode-iframe.php file...

CVE-2022-1985: Improper Neutralization of Input During Web Page Generation

The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the /src/Package/views/shortcode-iframe.php file...