# codename065 Download Manager. Every CVE that names codename065 Download Manager among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template \[author_name\]](https://agentprime.io/advisories/CVE-2026-119156.md) `CVE-2026-119156` · CVE record: codename065 Download Manager · CVSS 7.2 High · Not analysed yet · Published 7 Nov 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter](https://agentprime.io/advisories/CVE-2026-12054.md) `CVE-2026-12054` · CVE record: codename065 Download Manager · CVSS 6.1 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode](https://agentprime.io/advisories/CVE-2026-9696.md) `CVE-2026-9696` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email](https://agentprime.io/advisories/CVE-2026-103964.md) `CVE-2026-103964` · CVE record: codename065 Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-102401.md) `CVE-2026-102401` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name](https://agentprime.io/advisories/CVE-2026-97338.md) `CVE-2026-97338` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter](https://agentprime.io/advisories/CVE-2026-92714.md) `CVE-2026-92714` · CVE record: codename065 Download Manager · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control - [Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-16685.md) `CVE-2026-16685` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-14343.md) `CVE-2026-14343` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-13733.md) `CVE-2026-13733` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal](https://agentprime.io/advisories/CVE-2026-4057.md) `CVE-2026-4057` · CVE record: codename065 Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control - [Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-5357.md) `CVE-2026-5357` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter](https://agentprime.io/advisories/CVE-2026-2571.md) `CVE-2026-2571` · CVE record: codename065 Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Information disclosure - [Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter](https://agentprime.io/advisories/CVE-2026-1666.md) `CVE-2026-1666` · CVE record: codename065 Download Manager · CVSS 6.1 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword](https://agentprime.io/advisories/CVE-2025-15364.md) `CVE-2025-15364` · CVE record: codename065 Download Manager · CVSS 7.3 High · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-353 - [Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure](https://agentprime.io/advisories/CVE-2025-13498.md) `CVE-2025-13498` · CVE record: codename065 Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Broken access control - [Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key](https://agentprime.io/advisories/CVE-2025-12177.md) `CVE-2025-12177` · CVE record: codename065 Download Manager · CVSS 5.3 Medium · Not analysed yet · Published 8 Nov 2025 · Tags: Hard-coded credentials - [Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via \`user_ids\` Parameter](https://agentprime.io/advisories/CVE-2025-10146.md) `CVE-2025-10146` · CVE record: codename065 Download Manager · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode](https://agentprime.io/advisories/CVE-2025-4367.md) `CVE-2025-4367` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2025-3404.md) `CVE-2025-3404` · CVE record: codename065 Download Manager · CVSS 8.8 High · Not analysed yet · Published 19 Apr 2025 · Tags: Path traversal - [Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload](https://agentprime.io/advisories/CVE-2025-3056.md) `CVE-2025-3056` · CVE record: codename065 Download Manager · CVSS 5.4 Medium · Not analysed yet · Published 18 Apr 2025 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite](https://agentprime.io/advisories/CVE-2025-1785.md) `CVE-2025-1785` · CVE record: codename065 Download Manager · CVSS 5.4 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Path traversal - [Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files](https://agentprime.io/advisories/CVE-2024-11768.md) `CVE-2024-11768` · CVE record: codename065 Download Manager · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Broken access control - [Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2024-11740.md) `CVE-2024-11740` · CVE record: codename065 Download Manager · CVSS 7.3 High · Not analysed yet · Published 19 Dec 2024 · Tags: Code injection - [Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2024-6208.md) `CVE-2024-6208` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary](https://agentprime.io/advisories/CVE-2024-2098.md) `CVE-2024-2098` · CVE record: codename065 Download Manager · CVSS 7.5 High · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-289 - [Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-1766.md) `CVE-2024-1766` · CVE record: codename065 Download Manager · CVSS 4.4 Medium · Not analysed yet · Published 12 Jun 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes](https://agentprime.io/advisories/CVE-2024-5266.md) `CVE-2024-5266` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 12 Jun 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode](https://agentprime.io/advisories/CVE-2024-4001.md) `CVE-2024-4001` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode](https://agentprime.io/advisories/CVE-2024-4160.md) `CVE-2024-4160` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 31 May 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.84 - Missing Authorization](https://agentprime.io/advisories/CVE-2023-6785.md) `CVE-2023-6785` · CVE record: codename065 Download Manager · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: Broken access control - [Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2023-6954.md) `CVE-2023-6954` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2023-2305.md) `CVE-2023-2305` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 9 Jun 2023 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization](https://agentprime.io/advisories/CVE-2022-2436.md) `CVE-2022-2436` · CVE record: codename065 Download Manager · CVSS 8.8 High · Not analysed yet · Published 6 Sept 2022 · Tags: Insecure deserialization - [Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting](https://agentprime.io/advisories/CVE-2022-2101.md) `CVE-2022-2101` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 18 Jul 2022 · Tags: Cross-site scripting (XSS) - [Download Manager <= 3.2.42 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2022-1985.md) `CVE-2022-1985` · CVE record: codename065 Download Manager · CVSS 6.1 Medium · Not analysed yet · Published 13 Jun 2022 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .