Download Manager vulnerabilities
We track 6 vulnerabilities in Download Manager products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 27, 2026.
Latest Download Manager vulnerabilities
- 8.8 High severity
Download Manager: Improper Neutralization of Input During Web Page Generation
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-S
- 7.5 High severity
Download Manager: Improper Access Control
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked downloa
- 7.5 High severity
Download Manager: Incorrect Default Permissions
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
- 8.8 High severity
Download Manager: Externally Controlled Reference to a Resource in Another Sphere
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that
- 7.5 High severity
Download Manager: Improper Neutralization of Input During Web Page Generation
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions.
- 7.5 High severity
Download Manager: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restriction