Browse CVEs

HIGH 7.5 CVE-2022-0828 The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to b… Download Manager 3.2.34+ Fix from $1,9502022-04-11 HIGH 7.5 CVE-2021-25087 The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticate… Download Manager 3.2.35+ Fix from $1,9502022-03-07 HIGH 8.8 CVE-2021-25069 The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leadin… Download Manager 3.2.34+ Fix from $1,9502022-02-21 MEDIUM 5.4 CVE-2021-24969 The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such … Download Manager 3.2.22+ Fix from $1,6002021-12-27 HIGH 8.8 CVE-2021-34639 Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. … Download Manager after 3.1.24 Fix from $1,9502021-08-05 MEDIUM 6.5 CVE-2021-34638 Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration… Download Manager after 3.1.24 Fix from $1,6002021-08-05 MEDIUM 6.1 CVE-2019-15889EPSS 11% The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_… Download Manager 2.9.94+ Fix from $1,6002019-09-03 MEDIUM 6.1 CVE-2017-18497 The liveforms plugin before 3.4.0 for WordPress has XSS. Live Forms 3.4.0+ Fix from $1,6002019-08-13 CRITICAL 9.8 CVE-2015-9301 The liveforms plugin before 3.2.0 for WordPress has SQL injection. Live Forms 3.2.0+ Fix from $2,3002019-08-13 MEDIUM 6.1 CVE-2017-18032 The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php. Download Manager 2.9.52+ Fix from $1,6002018-01-16 HIGH 8.8 CVE-2014-9260EPSS 11% The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress opt… Download Manager 2.7.3+ Fix from $1,9502017-08-07 MEDIUM 6.1 CVE-2017-2216 Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HT… Download Manager after 2.9.49 Fix from $1,6002017-07-07 MEDIUM 6.1 CVE-2017-2217 Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites an… Download Manager after 2.9.50 Fix from $1,6002017-07-07 MEDIUM 5.0 CVE-2014-8585 Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (do… Download Manager No fix yet Fix from $1,6002014-11-04