CVE-2021-25087

The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords fixed in 3.2.24 and files Master Keys fixed ...

CVE-2021-25069

The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the packageids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue...

CVE-2021-24969

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages such as admin dashboard and frontend. Due to the lack of authorisation and CSRF checks in the wpdmsavetemplate AJAX action, any authenticated users such a...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Download Manager Plugin in versions prior to 3.2.16 has a cross-site scripting vulnerability that stems from a...

CVE-2019-15889

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter...

CVE-2017-18032

The CVE refers to the WordPress Download Manager plugin. Affected component: download-manager plugin for WordPress, vulnerable before version 2.9.52. Root cause: XSS via the id parameter in the wpdm_generate_password action targeting wp-admin/admin-ajax.php. Impact: cross-site scripting could all...

WordPress download manager plugin elevation of privilege vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.WordPress Download Manager is one of the file download management plugin. A security vulnerability exists in the...

CVE-2014-9260

The CVE-2014-9260 entry concerns the WordPress Download Manager plugin. The vulnerability is in the basic_settings function of the plugin before version 2.7.3, which allows remote authenticated users to update every WordPress option. This privilege escalation enables an attacker with existing WP ...

Wordpress Download Manager plugin cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress Download Manager plugin. An attacker can exploit the...

WordPress Download Manager Plugin - Arbitrary File Download

Because of this vulnerability, the attackers can read arbitrary files in the "fname" parameter to views/filedownload.php or filedownload.php. Solution Update the plugin...

CVE-2013-7319

CVE-2013-7319 concerns the WordPress Download Manager plugin prior to version 2.5.9. The vulnerability is a cross-site scripting (XSS) flaw in the title field, where user-supplied input can be injected as script/HTML and executed in the context of the affected site. The issue arises from insuffic...