Lana Downloads Manager Vulnerabilities

The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-...

CVSS:

5.5

Affected:

up to 1.10.0

Fixed in:

1.11.0

Disclosed:

Jul 9, 2025

CVE-2025-7387 on NVD →

The Lana Downloads Manager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.

CVSS:

4.9

Affected:

up to 1.9.0

Fixed in:

1.10.0

Disclosed:

Mar 11, 2025

CVE-2025-2048 on NVD →

The Lana Downloads Manager plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers, with contributor level permissions and above, to download arbitrary files on the affected site's server thus leaking sensitive informatio...

CVSS:

6.4

Affected:

up to 1.7.1

Fixed in:

1.8.0

Disclosed:

Aug 1, 2022

CVE-2022-2392 on NVD →