W3eden
W3eden Download Manager: vulnerabilidades y CVE
W3eden Download Manager tiene 48 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE48
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-4367 | Media (5.4) | 0.25% | — | 19 jun 2025 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization… |
| CVE-2024-8284 | Media (4.8) | 0.35% | — | 15 may 2025 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when… |
| CVE-2024-13126 | Media (4.6) | 0.47% | — | 16 mar 2025 | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files. |
| CVE-2025-1785 | Alta (8.1) | 0.66% | — | 13 mar 2025 | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with… |
| CVE-2024-56217 | Media (6.3) | 0.28% | — | 31 dic 2024 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03. |
| CVE-2024-10706 | Media (4.8) | 0.33% | — | 20 dic 2024 | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2024-11768 | Media (5.3) | 0.35% | — | 19 dic 2024 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including,… |
| CVE-2024-11740 | Alta (7.3) | 1.9% | — | 19 dic 2024 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not… |
| CVE-2024-8444 | Media (5.4) | 0.31% | — | 30 oct 2024 | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. |
| CVE-2024-6208 | Media (5.4) | 0.39% | — | 31 jul 2024 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization… |
| CVE-2024-2098 | Alta (7.5) | 0.45% | — | 13 jun 2024 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This… |
| CVE-2024-1766 | Media (5.4) | 0.33% | — | 12 jun 2024 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping.… |
| CVE-2024-5266 | Media (5.4) | 0.42% | — | 12 jun 2024 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes in all versions up to, and… |
| CVE-2024-4160 | Media (5.4) | 0.34% | — | 31 may 2024 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization… |
| CVE-2024-32131 | Alta (7.5) | 0.40% | — | 17 may 2024 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82. |
| CVE-2024-29114 | Media (5.4) | 0.34% | — | 19 mar 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84. |
| CVE-2023-6954 | Media (5.4) | 0.54% | — | 13 mar 2024 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output… |
| CVE-2023-6785 | Media (5.3) | 0.55% | — | 13 mar 2024 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to… |
| CVE-2023-6421 | Alta (7.5) | 2.4% | — | 1 ene 2024 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
| CVE-2023-2305 | Media (5.4) | 0.65% | — | 9 jun 2023 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient… |
| CVE-2023-1524 | Media (6.5) | 0.74% | — | 30 may 2023 | The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download… |
| CVE-2023-1809 | Alta (7.5) | 0.74% | — | 2 may 2023 | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. |
| CVE-2022-45836 | Media (6.1) | 0.68% | — | 18 abr 2023 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions. |
| CVE-2022-4476 | Media (5.4) | 0.57% | — | 16 ene 2023 | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to… |
| CVE-2022-2436 | Alta (8.8) | 2.0% | — | 6 sept 2022 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated… |
| CVE-2022-2431 | Alta (8.8) | 3.8% | — | 6 sept 2022 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found… |
| CVE-2022-36288 | Alta (8.8) | 0.34% | — | 23 ago 2022 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
| CVE-2022-34658 | Media (5.4) | 0.56% | — | 23 ago 2022 | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
| CVE-2022-34347 | Alta (8.8) | 0.37% | — | 22 ago 2022 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
| CVE-2022-2362 | Alta (7.5) | 1.2% | — | 22 ago 2022 | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.