W3Eden Download Manager vulnerabilities

CVE-2025-4367 [MEDIUM] CWE-80 CVE-2025-4367: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above,

CVE-2024-8284 [MEDIUM] CWE-79 CVE-2024-8284: The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its setting The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVE-2024-13126 [MEDIUM] CWE-552 CVE-2024-13126: The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.

CVE-2025-1785 [HIGH] CWE-22 CVE-2025-1785: The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.

CVE-2024-56217 [MEDIUM] CWE-862 CVE-2024-56217: Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03.

CVE-2024-10706 [MEDIUM] CWE-79 CVE-2024-10706: The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its setting The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2024-11740 [HIGH] CWE-94 CVE-2024-11740: The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcode

CVE-2024-11768 [MEDIUM] CWE-285 CVE-2024-11768: The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protect The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.

CVE-2024-8444 [MEDIUM] CWE-79 CVE-2024-8444: The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode paramete The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.

CVE-2024-6208 [MEDIUM] CWE-79 CVE-2024-6208: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above

CVE-2024-2098 [HIGH] CWE-289 CVE-2024-2098: The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an imp The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.

CVE-2024-1766 [MEDIUM] CWE-79 CVE-2024-1766: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that

CVE-2024-5266 [MEDIUM] CWE-79 CVE-2024-5266: The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_ The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes in all versions up to, and including, 3.2.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authe

CVE-2024-4160 [MEDIUM] CWE-79 CVE-2024-4160: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and a

CVE-2024-32131 [HIGH] CWE-200 CVE-2024-32131: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Ma Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.

CVE-2024-29114 [MEDIUM] CWE-79 CVE-2024-29114: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.

CVE-2023-6785 [MEDIUM] CWE-284 CVE-2023-6785: The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).

CVE-2023-6954 [MEDIUM] CWE-79 CVE-2023-6954: The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i

CVE-2023-6421 [HIGH] CWE-522 CVE-2023-6421: The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leak The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.

CVE-2023-2305 [MEDIUM] CWE-79 CVE-2023-2305: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-