CVE-2025-14399: Cross-Site Request Forgery (CSRF)

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the downloadpluginbulk and downloadthemebulk functions. This makes it possibl...

CVE-2024-9232: Improper Neutralization of Input During Web Page Generation

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to...

PT-2024-39508

Name of the Vulnerable Software and Affected Versions Download Plugins and Themes in ZIP from Dashboard plugin for WordPress versions up to, and including, 1.9.1 Description The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scriptin...

CVE-2024-7501: Cross-Site Request Forgery (CSRF)

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the downloadtheme function. This makes it possible for unauthenticated...

WordPress plugin: Download plugins and themes in ZIP format from the dashboard. Security vulnerabilities.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...