CVE-2024-1962

CVE-2024-1962 affects the CM Download Manager plugin for WordPress. The Red Hat entry and the initial description confirm that prior to version 2.9.1, the plugin lacks CSRF checks in certain areas, enabling a CSRF attack to cause logged-in admins to edit downloads. The description does not provid...

CVE-2024-1231

CVE-2024-1231 affects the CM Download Manager – WordPress plugin. The vulnerability arises because the plugin (pre-2.9.0) lacks CSRF protection in certain flows, enabling an attacker with a logged-in admin session to unpublish downloads via a CSRF request. Impact is authorisation-controlled (admi...

CVE-2024-1232

CM Download Manager (WordPress) is affected by CVE-2024-1232 due to missing CSRF protections in multiple areas, enabling CSRF-based actions that could allow an attacker to prompt a logged-in administrator to delete downloads. Root cause: CSRF checks not implemented consistently in the plugin prio...

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2020-27344

The CVE-2020-27344 entry corresponds to a Cross-Site Scripting (XSS) flaw in the WordPress plugin cm-download-manager, affected until version 2.8.0. The root cause is improper validation/sanitization of client-supplied data, specifically the uploaded filename in Content-Disposition, which can all...