# Download Manager

> This File Management & Digital Store plugin will help you to control file downloads & sell digital products from your WP site.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:32 UTC.

## Facts (WordPress.org)

- Slug: `download-manager`
- Author: Shahjada
- Version: 3.3.76
- Active installs: 90,000+
- Last update: 2026-11-07 (6 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.3, PHP any
- Tags: digital store, document management, download manager, ecommerce, file manager
- Page: https://wordpress.org/plugins/download-manager/

## Checks (against WordPress 7.1.4)

- OK: Updated 6 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Slow ↔ Responsive, Paywalled ↔ Generous, Cluttered ↔ Clean, Locked in ↔ Portable, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-12 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter (6.0.0 to 7.6.3). CVE-2026-120658, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4085834-3865-4b9e-9497-f14e6e32554b?source=api-prod
- 2026-11-11 LOW: Missing Authorization (before 3.3.73). CVE-2026-110948, https://wpscan.com/vulnerability/42a914ea-54fe-4a2b-b65b-8da152a37b43/
- 2026-11-11 LOW: Improper Authentication (before 3.3.73). CVE-2026-110949, https://wpscan.com/vulnerability/2ee629f0-d410-4272-991c-1eb6001fceb4/
- 2026-11-06 HIGH: Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name] (6.0.0 to 7.5.9). CVE-2026-119156, https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfe8902-9ddf-4dac-80ca-17589b737cd5?source=api-prod
- 2026-10-21 MEDIUM: Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery (up to 3.3.70, 4.0.0 to 7.5.8). CVE-2026-86611, https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb1e3ea-77ba-440a-a528-b477089101f6?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (up to 3.3.71). CVE-2026-102401, https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5985b0-0e6c-4dd8-b5f8-53be62adc8dd?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection... (up to 3.3.71). CVE-2026-103964, https://www.wordfence.com/threat-intel/vulnerabilities/id/84791a83-197b-4a73-826d-517bf47bc5c9?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode (up to 3.3.58). CVE-2026-9696, https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e11e8-de23-469e-9b96-3fc24b03bf98?source=api-prod
- 2026-10-10 MEDIUM: Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter (up to 3.3.57). CVE-2026-12054, https://www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140?source=api-prod
- 2026-10-02 MEDIUM: Unauthenticated Information Exposure (up to 3.3.70). CVE-2026-94405, https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a584-b741-4265-a878-9434140070dc?source=api-prod
- 2026-10-02 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (up to 3.3.70). CVE-2026-97338, https://www.wordfence.com/threat-intel/vulnerabilities/id/e04b75d4-9bf5-4b26-ac3a-88a10d200c50?source=api-prod
- 2026-09-18 MEDIUM: Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter (up to 3.3.68). CVE-2026-92714, https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64cc-75c2-46ba-a086-15a952a20026?source=api-prod
- 2026-08-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute (up to 3.3.66). CVE-2026-16685, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=api-prod
- 2026-08-01 HIGH: Unauthenticated Stored Cross-Site Scripting (before 3.3.66). CVE-2026-14292, https://www.wordfence.com/threat-intel/vulnerabilities/id/2105a26a-0813-4f63-a28d-6b3bd68ea9a1?source=api-prod
- 2026-07-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes (up to 3.3.61). CVE-2026-14343, https://www.wordfence.com/threat-intel/vulnerabilities/id/74cd34be-008c-4ff3-ae3c-417cfd2fee9b?source=api-prod
- 2026-07-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute (up to 3.3.60). CVE-2026-13733, https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf96aa9-2ee7-4411-8f43-3e8d023197bd?source=api-prod
- 2026-04-10 MEDIUM: Missing Authorization to Authenticated (Contributor+) Media File Protection Removal (up to 3.3.51). CVE-2026-4057, https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b02846-61be-4571-921d-53df5493f856?source=api-prod
- 2026-04-08 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (up to 3.3.52). CVE-2026-5357, https://www.wordfence.com/threat-intel/vulnerabilities/id/27fc81b0-c03a-4de7-bc38-791401d1685b?source=api-prod
- 2026-03-18 MEDIUM: Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter (up to 3.3.49). CVE-2026-2571, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3efaa0d-8af6-4cdf-9225-8bbcfdbb73d3?source=api-prod
- 2026-02-19 MEDIUM: Missing Authorization (up to 3.3.52). CVE-2026-39676, https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c652be-ea24-4fbe-aa88-ea1f8814d34a?source=api-prod
- 2026-02-17 MEDIUM: Reflected Cross-Site Scripting via 'redirect_to' Parameter (up to 3.3.46). CVE-2026-1666, https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb84ba3-b403-4a9d-b1a7-92aa947310ac?source=api-prod
- 2026-02-10 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 3.3.53). CVE-2026-39615, https://www.wordfence.com/threat-intel/vulnerabilities/id/0184b2b5-0b50-407e-8911-b0845714ea17?source=api-prod
- 2026-01-05 HIGH: Unauthenticated Limited Privilege Escalation via updatePassword (up to 3.3.40). CVE-2025-15364, https://www.wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=api-prod
- 2025-12-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure (up to 3.3.32). CVE-2025-13498, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=api-prod
- 2025-11-07 MEDIUM: Unauthenticated Cron Trigger due to Hardcoded Cron Key (up to 3.3.30). CVE-2025-12177, https://www.wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=api-prod
- 2025-09-30 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 3.3.32). CVE-2025-63070, https://www.wordfence.com/threat-intel/vulnerabilities/id/244eba91-343a-4e91-96b8-207686d02ce6?source=api-prod
- 2025-09-26 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 3.3.25). CVE-2025-60092, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3991601-a96c-4f98-a0f6-04a134ec6feb?source=api-prod
- 2025-09-26 MEDIUM: Cross-Site Request Forgery (up to 3.3.24). CVE-2025-60093, https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa54d4e-a633-48a4-83c0-33b7cbd2229a?source=api-prod
- 2025-09-18 MEDIUM: Reflected Cross-Site Scripting via `user_ids` Parameter (up to 3.3.23). CVE-2025-10146, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1adb414-8945-4e11-8770-dab3285d608e?source=api-prod
- 2025-06-18 MEDIUM: Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode (up to 3.3.18). CVE-2025-4367, https://www.wordfence.com/threat-intel/vulnerabilities/id/029956d7-6e3f-4159-9f53-05691e0262fc?source=api-prod
- 2025-04-18 HIGH: Authenticated (Author+) Arbitrary File Deletion (up to 3.3.12). CVE-2025-3404, https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8f5be-b513-4040-af39-c1a61d7e313f?source=api-prod
- 2025-04-17 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (up to 3.3.12). CVE-2025-3056, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8?source=api-prod
- 2025-03-12 MEDIUM: Authenticated (Author+) Path Traversal to Limited File Overwrite (up to 3.3.08). CVE-2025-1785, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5c7974-4c10-4880-8823-2accee3c0da4?source=api-prod
- 2025-01-17 MEDIUM: Unauthenticated Information Disclosure via Unprotected Directory (up to 3.3.06). CVE-2024-13126, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d07b7c1-8180-4b2a-bf35-2c5b3d419152?source=api-prod
- 2024-12-19 MEDIUM: Missing Authorization (up to 3.3.03). CVE-2024-56217, https://www.wordfence.com/threat-intel/vulnerabilities/id/25f0615b-17a1-4bf8-9f77-4703c39baca5?source=api-prod
- 2024-12-18 HIGH: Unauthenticated Arbitrary Shortcode Execution (up to 3.3.03). CVE-2024-11740, https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7be578-5883-4cd3-963d-bf81c3af2003?source=api-prod
- 2024-12-18 MEDIUM: Improper Authorization to Unauthenticated Download of Password-Protected Files (up to 3.3.03). CVE-2024-11768, https://www.wordfence.com/threat-intel/vulnerabilities/id/feb915f4-66d6-4f46-949c-5354e414319b?source=api-prod
- 2024-11-29 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 3.3.02). CVE-2024-10706, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a475f5-aafa-4717-b1a3-43f2ab8bce46?source=api-prod
- 2024-10-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.99). CVE-2024-8444, https://www.wordfence.com/threat-intel/vulnerabilities/id/df93727c-2d2f-4e13-8c89-3ffb93975180?source=api-prod
- 2024-09-23 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 3.2.98). CVE-2024-8284, https://www.wordfence.com/threat-intel/vulnerabilities/id/834bedf0-a2bc-4396-a160-3d3f399c1897?source=api-prod
- 2024-07-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.2.97). CVE-2024-6208, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c67d2f8-d918-42ef-a301-27eed7fa41b2?source=api-prod
- 2024-06-12 HIGH: Improper Authorization via protectMediaLibrary (up to 3.2.89). CVE-2024-2098, https://www.wordfence.com/threat-intel/vulnerabilities/id/1301c8af-d81a-40f1-96fa-e8252309d8a4?source=api-prod
- 2024-06-11 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes (up to 3.2.92). CVE-2024-5266, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e363a62-8d31-4140-878b-5034d6c7b6a1?source=api-prod
- 2024-06-11 MEDIUM: Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (up to 3.2.86). CVE-2024-1766, https://www.wordfence.com/threat-intel/vulnerabilities/id/9774c999-acb6-4c5f-ad6c-10979660b164?source=api-prod
- 2024-06-04 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode (up to 3.2.93). CVE-2024-4001, https://www.wordfence.com/threat-intel/vulnerabilities/id/b478d88d-1423-4a33-b8ef-08b9e66a5d98?source=api-prod
- 2024-05-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode (up to 3.2.90). CVE-2024-4160, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51258a-e228-412f-9d97-28ab679136d7?source=api-prod
- 2024-03-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.84). CVE-2024-29114, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb0da20-99f1-4bf1-8b30-3c8d15bf9679?source=api-prod
- 2024-02-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.2.85). CVE-2023-6954, https://www.wordfence.com/threat-intel/vulnerabilities/id/5cdd64a4-040b-4dc9-a8df-dbecfeb928c8?source=api-prod
- 2024-02-28 MEDIUM: Missing Authorization (up to 3.2.84). CVE-2023-6785, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3608ca-8ed6-46ff-8e57-d8b68f91b9f2?source=api-prod
- 2023-11-29 MEDIUM: Unauthenticated Password Leak (up to 3.2.82). CVE-2023-6421, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9cece7-a158-41ae-816b-1054da830724?source=api-prod
- 2023-05-12 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.2.70). CVE-2023-2305, https://www.wordfence.com/threat-intel/vulnerabilities/id/a66bc196-e5f8-46b4-a81c-c888eb64021c?source=api-prod
- 2023-05-08 MEDIUM: Insufficient Authorization to Information Disclosure (up to 3.2.70). CVE-2023-1524, https://www.wordfence.com/threat-intel/vulnerabilities/id/b48bc632-c825-48e0-8766-3ac59e5b87c6?source=api-prod
- 2023-04-10 MEDIUM: Unauthenticated Information Disclosure (4.0 to 6.3.0 (excl.)). CVE-2023-1809, https://www.wordfence.com/threat-intel/vulnerabilities/id/88d80702-a987-4b12-a003-2fa564fda409?source=api-prod
- 2022-12-20 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.61). CVE-2022-4476, https://www.wordfence.com/threat-intel/vulnerabilities/id/07a31d5c-b8c5-4523-8883-ba1e919c0ab1?source=api-prod
- 2022-11-29 MEDIUM: Refleced Cross-Site Scripting (up to 3.2.59). CVE-2022-45836, https://www.wordfence.com/threat-intel/vulnerabilities/id/10b46c11-1b34-4da4-a24d-103c663ca315?source=api-prod
- 2022-09-05 MEDIUM: Authenticated (Admin+) Path Traversal (before 3.2.55). CVE-2022-2926, https://www.wordfence.com/threat-intel/vulnerabilities/id/4e2527d4-750d-4e36-ae27-920105958c21?source=api-prod
- 2022-08-17 HIGH: Authenticated (Contributor+) PHAR Deserialization (up to 3.2.49). CVE-2022-2436, https://www.wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=api-prod
- 2022-08-04 MEDIUM: Reflected Cross-Site Scripting (up to 3.2.53). WF-332b8d96-89b2-473b-9186-239e49f5b064, https://www.wordfence.com/threat-intel/vulnerabilities/id/332b8d96-89b2-473b-9186-239e49f5b064?source=api-prod
- 2022-08-02 HIGH: Cross-Site Request Forgery to Plugin Settings Update (up to 3.2.48). CVE-2022-34347, https://www.wordfence.com/threat-intel/vulnerabilities/id/228147c2-97c6-4910-b9b2-d6ca62fc1760?source=api-prod
- 2022-08-02 HIGH: Cross-Site Request Forgery (up to 3.2.48). CVE-2022-36288, https://www.wordfence.com/threat-intel/vulnerabilities/id/4654609e-ed3e-4268-a9a4-80bc563e0a64?source=api-prod
- 2022-08-01 MEDIUM: IP Blocking Bypass (up to 3.2.49). CVE-2022-2362, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9611732-67aa-4940-8df1-c0ed7baad985?source=api-prod
- 2022-07-27 HIGH: Authenticated (Contributor+) Arbitrary File Deletion (up to 3.2.50). CVE-2022-2431, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c9c798-8545-475e-879b-7e44dac493f0?source=api-prod
- 2022-07-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.48). CVE-2022-34658, https://www.wordfence.com/threat-intel/vulnerabilities/id/41b3a62c-9586-4c87-828a-584dfe386a37?source=api-prod
- 2022-06-27 MEDIUM: Reflected Cross-Site Scripting (up to 3.2.43). CVE-2022-2168, https://www.wordfence.com/threat-intel/vulnerabilities/id/cace29fd-95d0-48ea-8dfa-6fd12dd9ccbf?source=api-prod
- 2022-06-23 MEDIUM: Reflected Cross-Site Scripting (up to 3.2.43). WF-9d72604e-23ef-4a69-8839-cf8ff4aef3bc, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d72604e-23ef-4a69-8839-cf8ff4aef3bc?source=api-prod
- 2022-06-21 MEDIUM: Contributor+ Cross-Site Scripting (up to 3.2.46). CVE-2022-2101, https://www.wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=api-prod
- 2022-06-02 MEDIUM: Reflected Cross-Site Scripting (up to 3.2.42). CVE-2022-1985, https://www.wordfence.com/threat-intel/vulnerabilities/id/79fcf18e-39f7-42f2-90e4-3a5bac3382e0?source=api-prod
- 2022-03-16 HIGH: Unauthenticated Brute Force of File Master Key (before 3.2.39). CVE-2022-0828, https://www.wordfence.com/threat-intel/vulnerabilities/id/feb056b0-5ea0-4257-8d58-0e29b3c304bd?source=api-prod
- 2022-02-02 HIGH: Sensitive Information Disclosure (before 3.2.35). CVE-2021-25087, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f24fae-6a8b-4c67-a204-c085ae43552f?source=api-prod
- 2022-01-20 HIGH: Authenticated SQL Injection (before 3.2.34). CVE-2021-25069, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e0136-f4fa-4739-b02d-b53091991e58?source=api-prod
- 2021-11-29 MEDIUM: Cross-Site Scripting (before 3.2.22). CVE-2021-24969, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a03e67-f36f-441a-a2fd-a545efa06c00?source=api-prod
- 2021-09-29 MEDIUM: Cross-Site Scripting (before 3.2.16). CVE-2021-24773, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a73d326-cd27-4719-8c26-3aa5dce837c0?source=api-prod
- 2021-08-09 HIGH: Cross-Site Request Forgery (before 3.2.13). WF-b0d8499a-a630-4c2b-9381-78ac83da119d, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d8499a-a630-4c2b-9381-78ac83da119d?source=api-prod
- 2021-07-29 HIGH: Authenticated File Upload (up to 3.1.24). CVE-2021-34639, https://www.wordfence.com/threat-intel/vulnerabilities/id/2cde1f4d-0212-48b1-a0ef-ba923c37ab50?source=api-prod
- 2021-07-29 MEDIUM: Cross-Site Scripting (up to 3.1.24). CVE-2021-34638, https://www.wordfence.com/threat-intel/vulnerabilities/id/776fc47e-a86c-43dc-8d5e-50273c4411b2?source=api-prod
- 2021-04-30 HIGH: Cross-Site Request Forgery (before 3.1.22). WF-4ccc8f3b-9028-45db-8db2-574736fe3ccb, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccc8f3b-9028-45db-8db2-574736fe3ccb?source=api-prod
- 2021-04-30 MEDIUM:  Arbitrary Asset Manager Usage (before 3.1.23). WF-6d700580-1374-4a17-a6b3-59ba1d063030, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d700580-1374-4a17-a6b3-59ba1d063030?source=api-prod
- 2021-04-30 HIGH: Arbitrary File Upload (before 3.1.19). WF-ed40b874-68e2-49f3-95b0-653600394e78, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed40b874-68e2-49f3-95b0-653600394e78?source=api-prod
- 2021-04-16 MEDIUM: Missing Authorization (before 3.1.18). WF-06738434-ccd4-4e87-8163-d56ff3b4b5c8, https://www.wordfence.com/threat-intel/vulnerabilities/id/06738434-ccd4-4e87-8163-d56ff3b4b5c8?source=api-prod
- 2019-06-16 MEDIUM: Cross-Site Scripting (before 2.9.97). WF-cad5274f-0d73-425d-bdfb-478c77d55d6c, https://www.wordfence.com/threat-intel/vulnerabilities/id/cad5274f-0d73-425d-bdfb-478c77d55d6c?source=api-prod
- 2019-04-13 MEDIUM: Cross-Site Scripting (before 2.9.94). CVE-2019-15889, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b602f33-ae2f-4349-a8be-901a9eec91c3?source=api-prod
- 2018-01-09 MEDIUM: Cross-Site Request Forgery (up to 2.9.6). WF-79b5883b-a3be-497e-b911-7dc39e7fb418, https://www.wordfence.com/threat-intel/vulnerabilities/id/79b5883b-a3be-497e-b911-7dc39e7fb418?source=api-prod
- 2017-07-13 MEDIUM: Open Redirect (before 2.9.51). CVE-2017-2217, https://www.wordfence.com/threat-intel/vulnerabilities/id/97690bde-f2c6-429b-8d5a-51bee4a981ca?source=api-prod
- 2017-06-16 MEDIUM: Cross-Site Scripting (up to 2.9.51). CVE-2017-18032, https://www.wordfence.com/threat-intel/vulnerabilities/id/44c31db3-6dfa-4d42-9c3b-73dde9bc49b9?source=api-prod
- 2017-06-13 MEDIUM: Reflected Cross-Site Scripting (before 2.9.50). CVE-2017-2216, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf90d284-9db8-464b-ae01-f1979408b351?source=api-prod
- 2017-03-01 HIGH: Cross-Site Request Forgery (up to 2.9.45). WF-f52aede5-21c3-46b9-800e-860a677a4b90, https://www.wordfence.com/threat-intel/vulnerabilities/id/f52aede5-21c3-46b9-800e-860a677a4b90?source=api-prod
- 2016-01-19 MEDIUM: Sensitive Information Disclosure via Directory Listing (before 2.8.8). WF-639bf20c-04d4-49e5-8da1-685421a6f63a, https://www.wordfence.com/threat-intel/vulnerabilities/id/639bf20c-04d4-49e5-8da1-685421a6f63a?source=api-prod
- 2016-01-19 MEDIUM: Privilege Escalation (before 2.8.8). WF-c59cddfb-c434-4a69-9c1c-7d58f022c1aa, https://www.wordfence.com/threat-intel/vulnerabilities/id/c59cddfb-c434-4a69-9c1c-7d58f022c1aa?source=api-prod
- 2016-01-19 CRITICAL: Missing Authorization (before 2.8.8). WF-d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0?source=api-prod
- 2015-07-16 MEDIUM: Stored Cross-Site Scripting (up to 2.7.94). WF-b3247bb3-3d9a-49b5-99ec-f4b305d37ae5, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3247bb3-3d9a-49b5-99ec-f4b305d37ae5?source=api-prod
- 2014-12-15 CRITICAL: Remote Code Execution (before 2.7.5). WF-5e491592-a17f-4789-8faa-d2a60b8ced70, https://www.wordfence.com/threat-intel/vulnerabilities/id/5e491592-a17f-4789-8faa-d2a60b8ced70?source=api-prod
- 2014-11-24 HIGH: Authenticated Arbitrary Options Update (before 2.7.3). CVE-2014-9260, https://www.wordfence.com/threat-intel/vulnerabilities/id/567782f9-a050-4e68-9491-e038d7e383f5?source=api-prod
- 2014-08-01 MEDIUM: Cross-Site Scripting (up to 2.2.2). WF-6a6390d2-58cd-468e-9936-e16954e2d3ee, https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6390d2-58cd-468e-9936-e16954e2d3ee?source=api-prod
- 2013-12-08 HIGH: Stored Cross-Site Scripting (up to 2.5.8). CVE-2013-7319, https://www.wordfence.com/threat-intel/vulnerabilities/id/446b160a-299e-4f91-bd49-02a7a16b6e5f?source=api-prod
- 2013-12-07 MEDIUM: Cross-Site Scripting (up to 2.5.8). WF-bd7c442f-5c91-4c52-933a-8a6fb7adca8c, https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7c442f-5c91-4c52-933a-8a6fb7adca8c?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=download-manager · HTML: https://todaywp.com/plugins/download-manager