WordPress download-manager has 44 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-15889 | The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search | medium | 6.1 | <2.9.94 | 2.9.94 |
| CVE-2014-9260 | The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every Word | high | 8.8 | <2.7.3 | 2.7.3 |
| CVE-2013-7319 | Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitra | medium | 4.3 | <=2.5.8 or =2.5.0 or =2.5.1 or =2.5.2 or =2.5.3 or =2.5.4 or =2.5.5 or =2.5.6 or =2.5.7 | – |
| CVE-2022-2431 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i | high | 8.1 | <=3.2.50 | – |
| CVE-2021-24773 | The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing h | medium | 4.8 | <3.2.16 | 3.2.16 |
| CVE-2014-8585 | Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via | medium | 5.0 | =1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.4 or =1.5 or =1.5.1 or =1.5.2 or =1.5.3 or =1.5.9 or =1.5.32 or =1.5.33 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.0.12 or =2.0.13 or =2.0.14 or =2.0.15 or =2.0.16 or =2.0.17 or =2.0.18 or =2.0.19 or =2.1.0 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2.4 or =2.2.5 or =2.2.6 or =2.2.7 or =2.2.8 or =2.2.9 or =2.3.0 or =2.3.1 or =2.3.2 or =2.3.3 or =2.3.4 or =2.3.5 or =2.3.6 or =2.3.7 or =2.3.8 or =2.3.9 or =2.4.0 or =2.4.1 or =2.4.2 or =2.4.3 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.8 or =2.4.9 or =2.5.0 or =2.5.1 or =2.5.2 or =2.5.3 or =2.5.4 or =2.5.5 or =2.5.6 or =2.5.7 or =2.5.8 or =2.5.9 or =2.5.91 or =2.5.92 or =2.5.93 or =2.5.94 or =2.5.95 or =2.5.96 or =2.5.97 or =2.5.98 or =2.5.99 or =2.6.0 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.4 or =2.6.5 or =2.6.6 or =2.6.7 or =2.6.8 or =2.6.9 or =2.6.91 or =2.6.92 or =2.6.93 or =2.6.94 or =2.6.95 or =2.6.96 | – |
| CVE-2023-6421 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. | high | 7.5 | <3.2.83 | 3.2.83 |
| CVE-2024-11740 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. T | high | 7.3 | <3.3.04 | 3.3.04 |
| CVE-2022-2436 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versi | high | 8.8 | <3.2.50 | 3.2.50 |
| CVE-2022-0828 | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an atta | high | 7.5 | <3.2.34 | 3.2.34 |
| CVE-2021-25087 | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unaut | high | 7.5 | <3.2.35 | 3.2.35 |
| CVE-2021-25069 | The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statemen | high | 8.8 | <3.2.34 | 3.2.34 |
| CVE-2017-2217 | Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web | medium | 6.1 | <=2.9.50 | – |
| CVE-2017-2216 | Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web scr | medium | 6.1 | <=2.9.49 | – |
| CVE-2022-2168 | The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history | medium | 6.1 | <3.2.44 | 3.2.44 |
| CVE-2021-34638 | Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive conf | medium | 6.5 | <=3.1.24 | – |
| CVE-2022-2362 | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whi | high | 7.5 | <3.2.50 | 3.2.50 |
| CVE-2022-1985 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is d | medium | 6.1 | <=3.2.42 | – |
| CVE-2022-2101 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, | medium | 6.4 | <=3.2.46 | – |
| CVE-2017-18032 | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-aj | medium | 6.1 | <2.9.52 | 2.9.52 |
| CVE-2023-1809 | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to downl | high | 7.5 | >=6.0.0 and <6.3.0 | 6.3.0 |
| CVE-2023-1524 | The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a | medium | 6.5 | <3.2.71 | 3.2.71 |
| CVE-2025-1785 | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_ne | medium | 5.4 | <3.3.09 | 3.3.09 |
| CVE-2023-2305 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_ | medium | 6.4 | <3.2.71 | 3.2.71 |
| CVE-2021-24969 | The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pag | medium | 5.4 | <3.2.22 | 3.2.22 |
| CVE-2022-4476 | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them ba | medium | 5.4 | <3.2.62 | 3.2.62 |
| CVE-2021-34639 | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extensi | high | 7.5 | <=3.1.24 | – |
| CVE-2022-34658 | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at | medium | 5.4 | <=3.2.48 | – |
| CVE-2023-6785 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, a | medium | 5.3 | <3.2.85 | 3.2.85 |
| CVE-2023-6954 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up | medium | 6.4 | <=3.2.85 | – |
| CVE-2024-13126 | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unaut | medium | 4.6 | <3.3.07 | 3.3.07 |
| CVE-2024-2098 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protec | high | 7.5 | <3.2.90 | 3.2.90 |
| CVE-2024-5266 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packa | medium | 6.4 | <3.2.94 | 3.2.94 |
| CVE-2024-6208 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all | medium | 6.4 | <3.2.98 | 3.2.98 |
| CVE-2022-34347 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 4.2 | <=3.2.48 | – |
| CVE-2024-8284 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | <3.2.99 | 3.2.99 |
| CVE-2024-11768 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password vali | medium | 5.3 | <3.3.04 | 3.3.04 |
| CVE-2022-36288 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | medium | 5.4 | <=3.2.48 | – |
| CVE-2024-4160 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all | medium | 6.4 | <3.2.90 | 3.2.90 |
| CVE-2024-1766 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and | medium | 4.4 | <3.2.87 | 3.2.87 |
| CVE-2024-8444 | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. | medium | 5.4 | <3.3.00 | 3.3.00 |
| CVE-2024-10706 | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | <3.3.03 | 3.3.03 |
| CVE-2024-4001 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in | medium | 6.4 | <3.2.94 | 3.2.94 |
| CVE-2025-4367 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all | medium | 6.4 | <3.3.19 | 3.3.19 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked