Vulnerabilities > Wpdownloadmanager

DATE CVE VULNERABILITY TITLE RISK
2022-06-24 CVE-2017-20093 Cross-Site Request Forgery (CSRF) vulnerability in Wpdownloadmanager Wordpress Download Manager 2.8.99
A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99.
network
low complexity
wpdownloadmanager CWE-352
4.3
2022-06-13 CVE-2022-1985 Unspecified vulnerability in Wpdownloadmanager Wordpress Download Manager
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42.
network
low complexity
wpdownloadmanager
6.1
2022-04-11 CVE-2022-0828 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Wpdownloadmanager Wordpress Download Manager
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
network
low complexity
wpdownloadmanager CWE-338
7.5
2022-03-07 CVE-2021-25087 Unspecified vulnerability in Wpdownloadmanager Wordpress Download Manager
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).
network
low complexity
wpdownloadmanager
7.5
2022-02-21 CVE-2021-25069 Unspecified vulnerability in Wpdownloadmanager Download Manager
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
network
low complexity
wpdownloadmanager
8.8
2021-12-27 CVE-2021-24969 Unspecified vulnerability in Wpdownloadmanager Wordpress Download Manager
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend).
network
low complexity
wpdownloadmanager
5.4
2021-11-01 CVE-2021-24773 Cross-site Scripting vulnerability in Wpdownloadmanager Wordpress Download Manager
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
network
low complexity
wpdownloadmanager CWE-79
4.8
2021-08-05 CVE-2021-34638 Path Traversal vulnerability in Wpdownloadmanager Wordpress Download Manager
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
network
low complexity
wpdownloadmanager CWE-22
6.5
2021-08-05 CVE-2021-34639 Unrestricted Upload of File with Dangerous Type vulnerability in Wpdownloadmanager Wordpress Download Manager
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g.
network
low complexity
wpdownloadmanager CWE-434
8.8
2019-09-03 CVE-2019-15889 Cross-site Scripting vulnerability in Wpdownloadmanager Wordpress Download Manager
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
network
low complexity
wpdownloadmanager CWE-79
6.1