What’s Vulnerable › Products

codename065 Download Manager vulnerabilities

78 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your codename065 Download Manager version is affected

Latest codename065 Download Manager vulnerabilities

• CVE-2026-86611 — Download Manager (Free & Pro) - Privacy Settings Update via CSRF (CVSS 4.3)
• CVE-2026-12054 — Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter (CVSS 6.1)
• CVE-2026-9696 — Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode (CVSS 6.4)
• CVE-2026-103964 — Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email (CVSS 4.3)
• CVE-2026-102401 — Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (CVSS 6.4)
• CVE-2026-94405 — WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability (CVSS 5.3)
• CVE-2026-97338 — Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (CVSS 6.4)
• CVE-2026-86610 — Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon (CVSS 6.4)
• CVE-2026-86609 — Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription (CVSS 8.8)
• CVE-2026-92714 — Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter (CVSS 6.5)
• CVE-2026-16685 — Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute (CVSS 6.4)
• CVE-2026-14292 — WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title (CVSS 5.4)
• CVE-2026-14235 — WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key (CVSS 7.5)
• CVE-2026-14343 — Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes (CVSS 6.4)
• CVE-2026-13733 — Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute (CVSS 6.4)
• CVE-2026-4057 — Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal (CVSS 4.3)
• CVE-2026-5357 — Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
• CVE-2026-39676 — WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-39615 — WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
• CVE-2026-2571 — Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter (CVSS 4.3)
• CVE-2026-1666 — Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter (CVSS 6.1)
• CVE-2025-15364 — Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword (CVSS 7.3)
• CVE-2025-13498 — Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure (CVSS 4.3)
• CVE-2025-63070 — WordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerability (CVSS 4.3)
• CVE-2025-12177 — Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key (CVSS 5.3)