CVE-2025-30782

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through = 1.2.9...

CVE-2025-2048

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server...

CVE-2025-2048

CVE-2025-2048 affects the Lana Downloads Manager WordPress plugin prior to 1.10.0. The issue is that input used to build a path is not validated, enabling admins to perform path traversal and download arbitrary server files. Public references confirm the vulnerability is tied to path traversal in...

CVE-2025-2048 Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server...

CVE-2025-2048 Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server...

CVE-2025-30910 WordPress CM Download Manager plugin <= 2.9.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through = 2.9.6...

CVE-2025-30882 WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through = 2.9.1...

CVE-2025-30882 WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through = 2.9.1...

CVE-2025-30882

The CVE-2025-30882 entry concerns JS Help Desk for WordPress with an Unauthenticated Path Traversal that allows Arbitrary File Download in versions up to 2.9.1. The vulnerability has a high potential impact (CVSS v3.1: 7.5, Attack Vector Network, Privileges None, User Interaction None) with Confi...

CVE-2025-30793

CVE-2025-30793 affects Houzez Property Feed (WordPress). An unauthenticated path traversal vulnerability allows arbitrary file download in versions up to and including 2.5.4 (root cause: improper limitation of a pathname to a restricted directory). CVSS v3.1 base score 7.5 (HIGH) with network acc...

CVE-2025-30793 WordPress Houzez Property Feed plugin <= 2.5.4 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Property Hive Houzez Property Feed houzez-property-feed allows Path Traversal.This issue affects Houzez Property Feed: from n/a through = 2.5.4...

CVE-2025-30782

CVE-2025-30782 corresponds to a WordPress vulnerability in the Subscribe to Download Lite plugin (

CVE-2025-30782 WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through = 1.2.9...

CVE-2025-30793 WordPress Houzez Property Feed plugin <= 2.5.4 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Property Hive Houzez Property Feed houzez-property-feed allows Path Traversal.This issue affects Houzez Property Feed: from n/a through = 2.5.4...

CVE-2025-30594 WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in samsk Include URL include-url allows Path Traversal.This issue affects Include URL: from n/a through = 0.3.5...

CVE-2025-30594 WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in samsk Include URL include-url allows Path Traversal.This issue affects Include URL: from n/a through = 0.3.5...

CVE-2025-30594

CVE-2025-30594 affects the WordPress Include URL plugin. The issue is a path traversal vulnerability (arbitrary file download) in Include URL, exploitable from n/a to version 0.3.5. Connected sources list this CVE under Include URL with Arbitrary File Download; patch status in provided docs is Un...

PT-2025-14067 · Unknown · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager versions n/a through 2.9.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access. Recommendations: Update to a...

WordPress plugin CM Download Manager 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2025-24167

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated...