Filtered by vendor Wp-downloadmanager Project Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-4799 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2025-07-09 7.2 High
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory.
CVE-2025-4798 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2025-07-09 4.9 Medium
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files.
CVE-2021-44760 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2025-04-23 4.8 Medium
Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions.
CVE-2022-25605 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2025-02-20 4.8 Medium
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
CVE-2022-25606 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2025-02-20 4.8 Medium
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
CVE-2020-24141 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2024-11-21 5.3 Medium
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services