CVE-2026-16685 | Medium | 6.4 | 2026-08-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3… |
CVE-2026-12800 | High | 7.5 | 2026-07-28 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/… |
CVE-2026-15906 | Medium | 6.5 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u… |
CVE-2026-15348 | Medium | 6.3 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 v… |
CVE-2026-14343 | Medium | 6.4 | 2026-07-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions… |
CVE-2026-13733 | Medium | 6.4 | 2026-07-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-4057 | Medium | 4.3 | 2026-04-10 | The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `… |
CVE-2026-5357 | Medium | 6.4 | 2026-04-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdm_members' shortcode in versions up t… |
CVE-2026-2571 | Medium | 4.3 | 2026-03-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in… |
CVE-2026-1666 | Medium | 6.1 | 2026-02-18 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including… |
CVE-2025-15364 | High | 7.3 | 2026-01-06 | The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due… |
CVE-2025-13498 | Medium | 4.3 | 2025-12-18 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is d… |
CVE-2025-12177 | Medium | 5.3 | 2025-11-08 | The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron(… |
CVE-2025-10146 | Medium | 6.1 | 2025-09-19 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3… |
CVE-2025-4367 | Medium | 6.4 | 2025-06-19 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, an… |
CVE-2025-3404 | High | 8.8 | 2025-04-19 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all… |
CVE-2025-3056 | Medium | 5.4 | 2025-04-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to… |
CVE-2025-1785 | Medium | 5.4 | 2025-03-13 | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This… |
CVE-2024-11768 | Medium | 5.3 | 2024-12-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the check… |
CVE-2024-11740 | High | 7.3 | 2024-12-19 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the s… |
CVE-2024-11225 | Medium | 6.1 | 2024-11-22 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with… |
CVE-2024-10164 | Medium | 6.4 | 2024-11-21 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmpp_pay_link shortc… |
CVE-2024-7386 | Medium | 4.3 | 2024-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5… |
CVE-2024-7560 | High | 7.2 | 2024-08-08 | The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input fro… |
CVE-2024-7486 | High | 8.8 | 2024-08-08 | The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization of untrusted input t… |
CVE-2024-6208 | Medium | 6.4 | 2024-07-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, an… |
CVE-2024-2098 | High | 7.5 | 2024-06-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' func… |
CVE-2024-1766 | Medium | 4.4 | 2024-06-12 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 d… |
CVE-2024-5266 | Medium | 6.4 | 2024-06-12 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_re… |
CVE-2024-4001 | Medium | 6.4 | 2024-06-05 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to… |
CVE-2024-4160 | Medium | 6.4 | 2024-05-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, an… |
CVE-2024-33938 | Medium | 6.5 | 2024-05-14 | Missing Authorization vulnerability in codename065 Sliding Widgets allows Cross-Site Scripting (XSS).This issue affects Sliding Widgets: from n/a through 1.5.0. |
CVE-2023-6954 | Medium | 6.4 | 2024-03-13 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2023-4293 | High | 8.8 | 2023-08-12 | The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to… |
CVE-2023-2305 | Medium | 6.4 | 2023-06-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in… |
CVE-2022-2436 | High | 8.8 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and incl… |
CVE-2022-2101 | Medium | 6.4 | 2022-07-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2… |
CVE-2022-1985 | Medium | 6.1 | 2022-06-13 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient… |