Advisories · Technology

Download Manager.

Every CVE that names Download Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-86611 CVE record

CVSS 4.3 Medium

Download Manager (Free & Pro) - Privacy Settings Update via CSRF
- Download Manager
- Cross-site request forgery (CSRF)
Not analysed yet 21 Oct 2026
CVE-2026-86610 CVE record

CVSS 6.4 Medium

Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 1 Oct 2026
CVE-2026-86609 CVE record

CVSS 8.8 High

Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 27 Sept 2026
CVE-2026-14292 CVE record

CVSS 5.4 Medium

WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 1 Aug 2026
CVE-2026-14235 CVE record

CVSS 7.5 High

WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
- Download Manager
- Broken access control
Not analysed yet 27 Jul 2026
CVE-2024-8284 CVE record

CVSS 4.8 Medium

Download Manager <= 3.2.98 - Admin+ Stored XSS
- Download Manager
Not analysed yet 15 May 2025
CVE-2024-13126 CVE record

CVSS 4.6 Medium

Download Manager < 3.3.07 - Unauthenticated Data Exposure
- Download Manager
Not analysed yet 16 Mar 2025
CVE-2024-10706 CVE record

CVSS 4.8 Medium

Download Manager < 3.3.03 - Admin+ Stored XSS
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 20 Dec 2024
CVE-2024-8444 CVE record

CVSS 5.4 Medium

Download Manager < 3.3.00 - Contributor+ Stored XSS
- Download Manager
Not analysed yet 30 Oct 2024
CVE-2023-6421 CVE record

CVSS 7.5 High

Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
- Download Manager
Not analysed yet 1 Jan 2024
CVE-2023-1524 CVE record

CVSS 6.5 Medium

Download Manager < 3.2.71 - Broken Access Controls
- Download Manager
Not analysed yet 30 May 2023
CVE-2023-1809 CVE record

CVSS 7.5 High

Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure
- Download Manager
- Broken access control
Not analysed yet 2 May 2023
CVE-2022-4476 CVE record

CVSS 5.4 Medium

Download Manager < 3.2.62 - Contributor+ Stored XSS
- Download Manager
Not analysed yet 16 Jan 2023
CVE-2022-2926 CVE record

CVSS 4.9 Medium

Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal
- Download Manager
- Path traversal
Not analysed yet 26 Sept 2022
CVE-2022-2362 CVE record

Download Manager < 3.2.50 - Bypass IP Address Blocking Restriction
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 22 Aug 2022
CVE-2022-2168 CVE record

Download Manager < 3.2.44 - Reflected Cross-Site Scripting
- Download Manager
- Cross-site scripting (XSS)
Not analysed yet 17 Jul 2022
CVE-2022-0828 CVE record

Download Manager < 3.2.39 - Unauthenticated brute force of files master key
- Download Manager
Not analysed yet 11 Apr 2022
CVE-2021-25087 CVE record

Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure
- Download Manager
- Broken access control
Not analysed yet 7 Mar 2022
CVE-2021-25069 CVE record

WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS
- Download Manager
- SQL injection
Not analysed yet 21 Feb 2022