codename065 Download Manager

• CVE-2026-12054 Medium 6.1 Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter 0.2%
• CVE-2026-9696 Medium 6.4 Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode 0.2%
• CVE-2026-103964 Medium 4.3 Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email 0.2%
• CVE-2026-102401 Medium 6.4 Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute 0.2%
• CVE-2026-97338 Medium 6.4 Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name 0.2%
• CVE-2026-92714 Medium 6.5 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter 0.4%
• CVE-2026-16685 Medium 6.4 Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute 0.4%
• CVE-2026-14343 Medium 6.4 Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes 0.3%
• CVE-2026-13733 Medium 6.4 Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute 0.4%
• CVE-2026-4057 Medium 4.3 Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal 0.4%
• CVE-2026-5357 Medium 6.4 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.3%
• CVE-2026-2571 Medium 4.3 Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter 0.2%
• CVE-2026-1666 Medium 6.1 Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter 0.3%
• CVE-2025-15364 High 7.3 Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword 0.2%
• CVE-2025-13498 Medium 4.3 Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure 0.4%
• CVE-2025-12177 Medium 5.3 Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key 0.2%
• CVE-2025-10146 Medium 6.1 Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter 0.2%
• CVE-2025-4367 Medium 6.4 Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode 0.3%
• CVE-2025-3404 High 8.8 Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion 1.2%
• CVE-2025-3056 Medium 5.4 Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 0.4%
• CVE-2025-1785 Medium 5.4 Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite 0.7%
• CVE-2024-11768 Medium 5.3 Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files 0.3%
• CVE-2024-11740 High 7.3 Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution 1.9%
• CVE-2024-6208 Medium 6.4 Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2024-2098 High 7.5 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary 0.5%
• CVE-2024-1766 Medium 4.4 Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting 0.3%
• CVE-2024-5266 Medium 6.4 Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes 0.4%
• CVE-2024-4001 Medium 6.4 Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode 0.3%
• CVE-2024-4160 Medium 6.4 Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode 0.3%
• CVE-2023-6785 Medium 5.3 Download Manager <= 3.2.84 - Missing Authorization 0.5%
• CVE-2023-6954 Medium 6.4 Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
• CVE-2023-2305 Medium 6.4 Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.6%
• CVE-2022-2436 High 8.8 Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization 1.8%
• CVE-2022-2101 Medium 6.4 Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting 1.1%
• CVE-2022-1985 Medium 6.1 Download Manager <= 3.2.42 - Reflected Cross-Site Scripting 1.2%