GCVE - cpe:2.3:a:cminds:cm_download_manager:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cminds:cm_download_manager:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Cminds (`b5402bde-9543-59be-8aae-b9b2097f562f`)
Product	Cm Download Manager (`de01eac5-cde0-53af-a7e1-c66dc079e1c6`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/wp-plugins/cm-download-manager`	purl2cpe	2026-06-01 10:15:33.777081

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-1962`	vulnerable	2026-06-08 06:27:15.139878	CM Download and File Manager < 2.9.1 - Download Edit via CSRF The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack Published: 2024-03-25T05:00:02.022Z Updated: 2024-08-28T13:58:15.934Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/469486d4-7677-4d66-83c0-a6b9ac7c503b/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1232`	vulnerable	2026-06-08 06:25:39.623343	CM Download Manager < 2.9.0 - Download Deletion via CSRF The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack Published: 2024-03-25T05:00:01.133Z Updated: 2024-08-09T20:00:16.433Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/2a29b509-4cd5-43c8-84f4-f86251dd28f8/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1231`	vulnerable	2026-06-08 06:25:39.620730	CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack Published: 2024-03-25T05:00:00.845Z Updated: 2025-03-19T20:04:28.792Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/7d3968d9-61ed-4c00-8764-0360cf03255e/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-3076`	vulnerable	2026-06-08 05:47:19.150096	CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example. Published: 2022-09-26T12:35:42.000Z Updated: 2025-05-22T15:41:20.288Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27344`	vulnerable	2026-06-08 05:23:52.611210	Details available The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. Published: 2020-10-21T19:09:23.000Z Updated: 2024-08-04T16:11:36.588Z Open on db.gcve.eu Reference links https://wordpress.org/plugins/cm-download-manager/#developers https://gist.github.com/qwebee/da79c6a9fa982c3c40988a1e0598c0d9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9129`	vulnerable	2026-06-08 05:06:10.922758	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.