WordPress Download Plugins and Themes in ZIP from Dashboard plugin <= 1.9.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Download Plugins and Themes from Dashboard versions = 1.9.1...

CVE-2024-35162: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...