CVE-2021-24969: Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-27 · updated 2026-06-17
Weakness: CWE-79

Description

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks

Affected products

codename065 Download Manager: before 3.2.22 — fixed in 3.2.22

How to fix

Upgrade to a fixed version: codename065 Download Manager 3.2.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24969 or the next vulnerability affects your stack