Filtered by vendor W3eden
Subscriptions
Filtered by product Download Manager
Subscriptions
Total
48 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2014-9260 | 1 W3eden | 1 Download Manager | 2025-04-20 | 8.8 High |
| The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option. | ||||
| CVE-2024-10706 | 1 W3eden | 1 Download Manager | 2025-04-17 | 4.8 Medium |
| The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2017-20093 | 1 W3eden | 1 Download Manager | 2025-04-15 | 4.3 Medium |
| A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. | ||||
| CVE-2014-8585 | 1 W3eden | 1 Download Manager | 2025-04-12 | N/A |
| Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php. | ||||
| CVE-2013-7319 | 1 W3eden | 1 Download Manager | 2025-04-11 | N/A |
| Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field. | ||||
| CVE-2024-8444 | 1 W3eden | 1 Download Manager | 2025-04-10 | 5.4 Medium |
| The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. | ||||
| CVE-2024-13126 | 1 W3eden | 1 Download Manager | 2025-04-09 | 4.6 Medium |
| The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files. | ||||
| CVE-2022-4476 | 1 W3eden | 1 Download Manager | 2025-04-04 | 5.4 Medium |
| The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. | ||||
| CVE-2021-25069 | 1 W3eden | 1 Download Manager | 2025-03-21 | 8.8 High |
| The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue | ||||
| CVE-2022-2168 | 1 W3eden | 1 Download Manager | 2025-03-21 | 6.1 Medium |
| The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting | ||||
| CVE-2022-45836 | 1 W3eden | 1 Download Manager | 2025-03-21 | 7.1 High |
| Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions. | ||||
| CVE-2023-1524 | 1 W3eden | 1 Download Manager | 2025-03-21 | 6.5 Medium |
| The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password. | ||||
| CVE-2024-29114 | 1 W3eden | 1 Download Manager | 2025-03-21 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84. | ||||
| CVE-2024-32131 | 1 W3eden | 1 Download Manager | 2025-03-21 | 5.3 Medium |
| Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82. | ||||
| CVE-2023-1809 | 1 W3eden | 1 Download Manager | 2025-03-21 | 7.5 High |
| The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. | ||||
| CVE-2017-18032 | 1 W3eden | 1 Download Manager | 2025-03-21 | N/A |
| The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php. | ||||
| CVE-2022-34347 | 1 W3eden | 1 Download Manager | 2025-03-21 | 4.2 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. | ||||
| CVE-2019-15889 | 1 W3eden | 1 Download Manager | 2025-03-21 | N/A |
| The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter. | ||||
| CVE-2021-34638 | 1 W3eden | 1 Download Manager | 2025-03-21 | 6.5 Medium |
| Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions. | ||||
| CVE-2021-34639 | 1 W3eden | 1 Download Manager | 2025-03-21 | 7.5 High |
| Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions. | ||||