Show filters
46 Total Results
Displaying 31-40 of 46
Sort by:
Attacker Value
Unknown
CVE-2021-44760
Disclosure Date: December 28, 2021 (last updated February 23, 2025)
Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions.
0
Attacker Value
Unknown
CVE-2021-24969
Disclosure Date: December 27, 2021 (last updated February 23, 2025)
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
0
Attacker Value
Unknown
CVE-2021-24773
Disclosure Date: November 01, 2021 (last updated February 23, 2025)
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
0
Attacker Value
Unknown
CVE-2021-34638
Disclosure Date: August 05, 2021 (last updated February 23, 2025)
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
0
Attacker Value
Unknown
CVE-2021-34639
Disclosure Date: August 05, 2021 (last updated February 23, 2025)
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
0
Attacker Value
Unknown
CVE-2020-24141
Disclosure Date: July 07, 2021 (last updated February 23, 2025)
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
0
Attacker Value
Unknown
CVE-2019-15889
Disclosure Date: September 03, 2019 (last updated November 27, 2024)
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
0
Attacker Value
Unknown
CVE-2017-18032
Disclosure Date: January 16, 2018 (last updated November 26, 2024)
The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.
0
Attacker Value
Unknown
CVE-2014-9260
Disclosure Date: August 07, 2017 (last updated November 26, 2024)
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
0
Attacker Value
Unknown
CVE-2017-2216
Disclosure Date: July 07, 2017 (last updated November 26, 2024)
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
