Download Manager

Vulnerabilities 106Slug download-managerLatest version 3.3.55WordPress.org →

Minimum safe version

3.3.54

Update to 3.3.54 or later to address 105 fixable vulnerabilities

Latest available3.3.55 ✓Affected up to2.7.4 ⚠
Medium 6.1
2025-09-19< 3.3.24

Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter

EUVDWordfenceCVE
N/A
2026-02-17< 3.3.47

Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter

WordfenceCVE
N/A
2026-03-18< 3.3.50

Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter

WordfenceCVE
N/A
2026-04-08< 3.3.53

Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

WordfenceCVE
N/A
2026-04-09< 3.3.52

Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal

WordfenceCVE
Medium 6.4
2025-06-19< 3.3.19

Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode

EUVDWordfenceCVE
High 8.8
2025-04-18< 3.3.13

Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion

WordfenceCVE
Medium 5.4
2025-04-18< 3.3.13

Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

EUVDWordfenceCVE
Medium 5.4
2025-03-13< 3.3.09

Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite

EUVDWordfenceCVE
Medium 4.8
2025-05-15< 3.2.99

Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting

EUVDWordfenceCVE
N/A
2013-12-07< 2.5.9

Download Manager <= 2.5.8 - Cross-Site Scripting

Wordfence
N/A
2014-08-01< 2.2.3

Download Manager <= 2.2.2 - Cross-Site Scripting

Wordfence
N/A
2014-12-15< 2.7.5

WordPress Download Manager <= 2.7.4 - Remote Code Execution

Wordfence
N/A
2015-07-16< 2.7.95

WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting

Wordfence
N/A
2016-01-19< 2.8.8

Download Manager <= 2.8.7 - Missing Authorization

Wordfence
N/A
2016-01-19< 2.8.8

Download Manager <= 2.8.7 - Privilege Escalation

Wordfence
N/A
2016-01-19< 2.8.8

Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing

Wordfence
N/A
2017-03-01< 2.9.46

WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery

Wordfence
N/A
2018-01-09< 2.9.61

WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery

Wordfence
N/A
2019-06-16< 2.9.97

WordPress Download Manager <= 2.9.96 - Cross-Site Scripting

Wordfence
N/A
2021-04-16< 3.1.17

Download Manager <= 3.1.17 - Missing Authorization

Wordfence
N/A
2021-04-30< 3.1.19

WordPress Download Manager < 3.1.19 - Arbitrary File Upload

Wordfence
N/A
2021-04-30< 3.1.23

WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage

Wordfence
N/A
2021-04-30< 3.1.22

WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery

Wordfence
N/A
2021-08-09< 3.2.13

WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery

Wordfence
N/A
2022-06-23< 3.2.44

Download Manager <= 3.2.43 - Reflected Cross-Site Scripting

Wordfence
N/A
2022-08-04< 3.2.54

Download Manager <= 3.2.53 - Reflected Cross-Site Scripting

Wordfence
N/A
< 3.2.60

WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
< 2.2.3

Download Manager &lt;= 2.2.2 - admin.php cid Parameter XSS

WPScan
N/A
< 2.7.5

Download Manager &lt;= 2.7.4 - Code Execution / Remote File Inclusion

WPScan
N/A
< 2.7.95

Download Manager &lt;= 2.7.94 - Authenticated Stored XSS

WPScan
N/A
< 2.8.8

Download Manager &lt;= 2.8.7 - Multiple Vulnerabilities

WPScan
N/A
< 2.9.46

Download Manager &lt;= 2.9.45 - Cross-Site Request Forgery (CSRF)

WPScan
N/A
< 2.9.61

Download Manager &lt;= 2.9.60 - Cross-Site Request Forgery (CSRF)

WPScan
N/A
< 2.9.97

Download Manager &lt;= 2.9.96 - Various Sanitisation Issues

WPScan
N/A
< 3.1.18

WordPress Download Manager &lt; 3.1.18 - Unauthorised Download Duplication

WPScan
N/A
< 3.1.23

Download Manager &lt; 3.1.23 - Unauthorised Asset Manager Usage

WPScan
N/A
< 3.1.22

Download Manager &lt; 3.1.22 - Plugin Settings Change via CSRF

WPScan
N/A
< 3.1.19

Download Manager &lt; 3.1.19 - Authenticated (author+) PHP4 File Upload to RCE

WPScan
N/A
< 3.2.13

WordPress Download Manager &lt; 3.2.13 - Email Template Setting Update via CSRF

WPScan
N/A
< 3.2.44

Download Manager &lt; 3.2.44 - Unauthenticated Reflected Cross-Site Scripting

WPScan
N/A
< 3.2.53

Download Manager &lt; 3.2.53 - Unauthenticated Reflected Cross-Site Scripting

WPScan
N/A
2022-06-27< 3.2.44

WordPress Download Manager plugin <= 3.2.43 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2014-12-15≥ 2.7.0 and ≤ 2.7.4

WordPress Download Manager 2.7.4 - Remote Code Execution

Patchstack
N/A
2015-05-15< 2.2.3

WordPress Download Manager Plugin <= 2.2.2 - XSS

Patchstack
N/A
2015-07-16< 2.7.95

WordPress Download Manager Free 2.7.94 & Pro 4 - Authenticated Stored XSS

Patchstack
N/A
2015-12-20< 2.7.95

WordPress Download Manager Plugin <= 2.7.94 - Stored XSS

Patchstack
N/A
2016-01-19< 2.8.8

WordPress Download Manager Plugin <= 2.8.7 - Multiple Vulnerabilities

Patchstack
N/A
2017-06-27< 2.9.46

WordPress Download Manager plugin <= 2.8.97 - Authenticated Arbitrary File Upload Vulnerability

Patchstack
N/A
2018-01-10< 2.9.61

WordPress Download Manager plugin <=2.9.60 - Cross-Site Request Forgery (CSRF) vulnerability

Patchstack
N/A
2019-04-23< 2.9.94

WordPress Download Manager plugin <= 2.9.93 - Authenticated Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2019-06-16< 2.9.97

WordPress Download Manager plugin <= 2.9.96 - Multiple vulnerabilities

Patchstack
N/A
2021-08-09< 3.2.13

WordPress Download Manager plugin <= 3.2.12 - Email Template Setting Update via Cross-Site Request Forgery (CSRF) vulnerability

Patchstack
Medium 6.1
2017-07-13< 2.9.51

WordPress Download Manager < 2.9.51 - Open Redirect

WordfenceCVEJVNWPScan