Wp-downloadmanager Project

Wp-downloadmanager

6 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.2

CVE-2025-4799

  • EPSS 1.26%
  • Published 11.06.2025 03:41:53
  • Last modified 09.07.2025 19:11:14

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attack...

4.9

CVE-2025-4798

  • EPSS 0.04%
  • Published 11.06.2025 03:41:52
  • Last modified 09.07.2025 19:03:51

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it pos...

5.4

CVE-2022-25606

  • EPSS 0.16%
  • Published 25.03.2022 19:15:10
  • Last modified 21.11.2024 06:52:25

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.

5.4

CVE-2022-25605

  • EPSS 0.17%
  • Published 18.03.2022 18:15:16
  • Last modified 21.11.2024 06:52:25

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.

5.4

CVE-2021-44760

  • EPSS 0.18%
  • Published 18.03.2022 18:15:11
  • Last modified 21.11.2024 06:31:32

Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions.

5.3

CVE-2020-24141

  • EPSS 0.19%
  • Published 07.07.2021 14:15:09
  • Last modified 21.11.2024 05:14:25

Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify ...