W3Eden Download Manager vulnerabilities

CVE-2024-8444 [MEDIUM] CWE-79 CVE-2024-8444: The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode paramete The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.

CVE-2017-2217 [MEDIUM] CWE-601 CVE-2017-2217: Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote atta Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

CVE-2022-34658 [MEDIUM] CWE-79 CVE-2022-34658: Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Ed Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

CVE-2025-4367 [MEDIUM] CWE-80 CVE-2025-4367: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above,

CVE-2021-24773 [MEDIUM] CWE-79 CVE-2021-24773: The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download s The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed

CVE-2017-20093 [MEDIUM] CWE-352 CVE-2017-20093: A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. A A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely.

CVE-2024-8284 [MEDIUM] CWE-79 CVE-2024-8284: The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its setting The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVE-2024-10706 [MEDIUM] CWE-79 CVE-2024-10706: The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its setting The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).