Wp-downloadmanager Project Wp-downloadmanager — known CVE vulnerabilities

Every CVE whose affected-product data names Wp-downloadmanager Project Wp-downloadmanager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2025-4799 — CVSS 7.2 (high): The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can…
• CVE-2020-24141 — CVSS 5.3 (medium): Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end…
• CVE-2025-4798 — CVSS 4.9 (medium): The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due…
• CVE-2021-44760 — CVSS 4.8 (medium): Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions.
• CVE-2022-25605 — CVSS 4.8 (medium): Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <=…
• CVE-2022-25606 — CVSS 4.8 (medium): Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <=…