Vulnerabilities > W3Eden
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-23 | CVE-2022-34658 | Cross-site Scripting vulnerability in W3Eden Download Manager Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | 5.4 |
| 2022-08-23 | CVE-2022-36288 | Cross-Site Request Forgery (CSRF) vulnerability in W3Eden Download Manager Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | 8.8 |
| 2022-08-22 | CVE-2022-2362 | Unspecified vulnerability in W3Eden Download Manager The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions. | 7.5 |
| 2022-08-22 | CVE-2022-34347 | Cross-Site Request Forgery (CSRF) vulnerability in W3Eden Download Manager Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | 8.8 |
| 2022-07-18 | CVE-2022-2101 | Unspecified vulnerability in W3Eden Download Manager The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. | 5.4 |
| 2022-07-17 | CVE-2022-2168 | Cross-site Scripting vulnerability in W3Eden Download Manager The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting | 6.1 |
| 2022-06-24 | CVE-2017-20093 | Cross-Site Request Forgery (CSRF) vulnerability in W3Eden Download Manager 2.8.99 A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. | 4.3 |
| 2022-06-13 | CVE-2022-1985 | Unspecified vulnerability in W3Eden Download Manager The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. | 6.1 |
| 2022-04-11 | CVE-2021-36896 | Cross-site Scripting vulnerability in W3Eden Pricing Table 1.5.2 Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2 | 4.8 |
| 2022-04-11 | CVE-2022-0828 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in W3Eden Download Manager The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download. | 7.5 |