PatchTheCVEdownload manager vulnerabilities and fixes
Recent CVEs affecting download manager, with upgrade or downgrade steps. 15 tracked.
Also searched as: downloadmanager.
download manager has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2025-05-15. Highest priority: CVE-2024-11740 (score 50/100).
- CVE-2025-1785 MEDIUM 5.4 UPGRADE The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and incl
- CVE-2024-8444 MEDIUM 5.4 UPGRADE The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leadin
- CVE-2024-8284 MEDIUM 4.8 UPGRADE The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which c
- CVE-2024-6208 MEDIUM 6.4 UPGRADE The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_
- CVE-2024-5266 MEDIUM 6.4 UPGRADE The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashb
- CVE-2024-56217 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectl
- CVE-2024-4160 MEDIUM 6.4 UPGRADE The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-
- CVE-2024-4001 MEDIUM 6.4 UPGRADE The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_
- CVE-2024-32131 MEDIUM 5.3 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc
- CVE-2024-2098 HIGH 7.5 UPGRADE The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper auth
- CVE-2024-1766 MEDIUM 4.4 UPGRADE The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Na
- CVE-2024-13126 MEDIUM 4.6 UPGRADE The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don'
- CVE-2024-11768 MEDIUM 5.3 UPGRADE The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content
- CVE-2024-11740 HIGH 7.3 UPGRADE The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u
- CVE-2024-10706 MEDIUM 4.8 UPGRADE The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which c
FAQ
How do I fix download manager vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is download manager being exploited right now?
None of the tracked download manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which download manager CVE should I patch first?
CVE-2024-11740 currently ranks highest (50/100): The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u.