Medium
CVE-2026-12054
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 102
Reset filters
Medium
CVE-2026-9696
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Medium
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Medium
CVE-2026-102401
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Medium
CVE-2026-94405
Download Manager <= 3.3.70 - Unauthenticated Information Exposure
Medium
CVE-2026-97338
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Medium
CVE-2026-92714
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
High
CVE-2026-14292
Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16685
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Medium
CVE-2026-14343
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Medium
CVE-2026-13733
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Medium
CVE-2026-4057
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
Medium
CVE-2026-5357
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-2571
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Medium
CVE-2026-39676
Download Manager <= 3.3.52 - Missing Authorization
Medium
CVE-2026-1666
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
Medium
CVE-2026-39615
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-15364
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
Medium
CVE-2025-13498
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
Medium
CVE-2025-12177
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
Medium
CVE-2025-63070
Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-60093
Download Manager <= 3.3.24 - Cross-Site Request Forgery
Medium
CVE-2025-60092
Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-10146
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.