Login Request a demo
DM
Product
Download Manager
by codename065 · last CVE Oct 10, 2026
23
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Vulnerabilities23In the news0Timeline
Severity mix
Critical 0High 4Medium 19Low 0
Severity
All severities23Critical0High4Medium19Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Download Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-92714
6.5
0%
Sep 18
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Affected: through 3.3.68
CVE-2026-9696
6.4
0%
Oct 10
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Affected: through 3.3.58
CVE-2026-102401
6.4
0%
Oct 10
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Affected: through 3.3.71
CVE-2026-97338
6.4
0%
Oct 2
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Affected: through 3.3.70
CVE-2026-16685
6.4
0%
Aug 1
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Affected: through 3.3.66
CVE-2026-14343
6.4
0%
Jul 9
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Affected: through 3.3.61
CVE-2026-13733
6.4
0%
Jul 1
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Affected: through 3.3.60
CVE-2026-5357
6.4
0%
Apr 9
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Affected: through 3.3.52
CVE-2026-12054
6.1
0%
Oct 10
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Affected: through 3.3.57
CVE-2026-1666
6.1
0%
Feb 18
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Affected: through 3.3.46
CVE-2025-10146
6.1
0%
Sep 19
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
Affected: through 3.3.23
CVE-2025-4367
5.4
0%
Jun 19
Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
Affected: through 3.3.18
CVE-2025-3056
5.4
0%
Apr 18
Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Affected: through 3.3.12
CVE-2025-12177
5.3
0%
Nov 8
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
Affected: through 3.3.30
CVE-2024-11768
5.3
0%
Dec 19
Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
Affected: through 3.3.03
CVE-2026-103964
4.3
0%
Oct 10
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Affected: through 3.3.71
CVE-2026-4057
4.3
0%
Apr 10
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
Affected: through 3.3.51
CVE-2026-2571
4.3
0%
Mar 19
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Affected: through 3.3.49
CVE-2025-13498
4.3
0%
Dec 18
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
Affected: through 3.3.32
Showing 19