Downloadmanager Vulnerabilities

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.3.70. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

(Wordfence)

Affected:

up to 3.3.70

Fixed in:

3.3.71

Disclosed:

Sep 29, 2026

CVE-2026-86610 on NVD →

The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute when...

CVSS:

7.2

(Wordfence)

Affected:

up to 7.5.5

Fixed in:

7.5.6

Disclosed:

Sep 25, 2026

CVE-2026-86609 on NVD →

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.61. This makes it possible for authenticated attackers, with Custom-level access and above, to download files via a reusable download key.

CVSS:

4.3

(Wordfence)

Affected:

up to 3.3.61

Fixed in:

3.3.62

Disclosed:

Jul 6, 2026

CVE-2026-14235 on NVD →

The Download Manager plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.2.82. This makes it possible for unauthenticated attackers to bypass password protected file restrictions

CVSS:

5.3

(Wordfence)

Affected:

up to 3.2.82

Fixed in:

3.2.83

Disclosed:

Apr 12, 2024

CVE-2024-32131 on NVD →