Download Manager

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:w3eden:download_manager:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorW3Eden (10d19c2d-88f9-5ed9-a1d6-9d8728854bcc)
ProductDownload Manager (78cd69d8-2561-5605-ad6e-6868c565cd1e)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-8444 vulnerable 2026-06-08 07:00:24.661468 Download Manager < 3.3.00 - Contributor+ Stored XSS
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
Published: 2024-10-30T06:00:03.652Z
Updated: 2024-10-30T13:38:38.940Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-1766 vulnerable 2026-06-08 06:27:14.437024 Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
MEDIUM (4.4)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.
Published: 2024-06-12T11:05:08.210Z
Updated: 2026-04-08T17:10:25.840Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.