Ogni versione viene ripulita, confrontata con il codice di licenza del produttore e analizzata prima del commit. Una versione che non supera i controlli non viene pubblicata.
Versioni pubblicate0
File analizzati0
Risultati esaminati0
Versioni trattenute6
Trattenuti: archivi di questo plugin che non hanno superato i controlli automatici e non sono pubblicati. Risultati esaminati: corrispondenze delle regole che sono state verificate e risolte prima della pubblicazione.
Come viene controllata ogni versione
Scansione malwareClamAV
Ogni file di ogni versione confrontato con il database di firme di ClamAV.
Regole di patternYARA
Web shell, loader offuscati, PHP codificato e pattern di nulling noti (php-malware-finder più le regole di MeteorGPL).
Analisi PHPEuristiche
Analisi a livello di token: include remoti, input della richiesta che raggiunge funzioni di shell, decoder che alimentano eval, PHP nascosto in immagini, font o archivi, override degli handler del server.
Integrità della licenzaFirme anti-nulling
Il codice di licenza, attivazione e aggiornamento viene confrontato con il codice del produttore e con la versione precedente; il codice di licenza alterato non viene mai pubblicato.
Sintassi PHPLint PHP
Ogni file PHP è sintatticamente valido con la versione di PHP supportata dal repository.
Politica sulle risorse0 immagini sostituite · 0 file rimossi
Grafica, font, media e contenuti demo che possono avere una licenza separata vengono sostituiti con segnaposto o rimossi.
Scansioni per versione
Versione
Scansione
File
Firme ClamAV
Risultati esaminati
Risorse sostituite
Durata
Risultato
Politica di sicurezza
Segnalare una vulnerabilità. I problemi di sicurezza nel codice del plugin stesso riguardano il produttore, WordPress Download Manager; segnalali a quest’ultimo. I problemi con un pacchetto così come lo distribuisce questo repository — un file che non dovrebbe esserci, una scansione che ha mancato qualcosa — vanno segnalati a packages@meteorgpl.com e ricevono risposta entro 48 ore.
Cosa succede quando c’è un riscontro. Le versioni interessate vengono ritirate dal repository, chi segue il pacchetto viene avvisato e viene pubblicata una versione corretta non appena ce n’è una che supera tutti i controlli.
Titolari dei diritti. La politica di rimozione descrive come viene rimosso un pacchetto.
Vulnerabilità note
Segnalazioni pubbliche di vulnerabilità per Download Manager Pro, le versioni interessate e la versione di questo repository che le corregge. Chi segue il pacchetto e gli account che sappiamo usare una versione interessata vengono avvisati.
Il produttore l’ha corretta in 3.3.71, 7.5.9; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.5.8 (pro) & 3.3.71 (free). This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to one of the following versions, or a newer patched version: 3.3.71, 7.5.9
Il produttore l’ha corretta in 3.3.58; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Rimedio: Update to version 3.3.58, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.59; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.3.59, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.72; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
Rimedio: Update to version 3.3.72, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.3.72; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected.
Rimedio: Update to version 3.3.72, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.71; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.70. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Rimedio: Update to version 3.3.71, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.3.71; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Rimedio: Update to version 3.3.71, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.69; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Rimedio: Update to version 3.3.69, or a newer patched version
CWE-639: Authorization Bypass Through User-Controlled Key
Il produttore l’ha corretta in 3.3.66; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.3.66, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.67; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
Rimedio: Update to version 3.3.67, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.62; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
Rimedio: Update to version 3.3.62, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.61; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.
Rimedio: Update to version 3.3.61, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.52; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.
Rimedio: Update to version 3.3.52, or a newer patched version
Il produttore l’ha corretta in 3.3.53; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdm_members' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute. The sid parameter is extracted without sanitization in the members() function and stored via update_post_meta(), then echoed directly into an HTML id attribute in the members.php template without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Rimedio: Update to version 3.3.53, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.50; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
Rimedio: Update to version 3.3.50, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.3.53; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.3.52. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Rimedio: Update to version 3.3.53, or a newer patched version
Il produttore l’ha corretta in 3.3.47; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Rimedio: Update to version 3.3.47, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.54; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.3.54, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.41; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change user's passwords, except administrators, and leverage that to gain access to their account.
Rimedio: Update to version 3.3.41, or a newer patched version
Il produttore l’ha corretta in 3.3.33; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.
Rimedio: Update to version 3.3.33, or a newer patched version
Il produttore l’ha corretta in 3.3.31; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.
Rimedio: Update to version 3.3.31, or a newer patched version
Il produttore l’ha corretta in 3.3.33; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.
Rimedio: Update to version 3.3.33, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.3.26; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.25. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Rimedio: Update to version 3.3.26, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.3.25; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.24. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 3.3.25, or a newer patched version
Il produttore l’ha corretta in 3.3.24; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3.3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Rimedio: Update to version 3.3.24, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.19; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.3.19, or a newer patched version
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page
Il produttore l’ha corretta in 3.3.13; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Rimedio: Update to version 3.3.13, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Il produttore l’ha corretta in 3.3.13; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Rimedio: Update to version 3.3.13, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.09; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.
Rimedio: Update to version 3.3.09, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Il produttore l’ha corretta in 3.3.07; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 3.3.06. This is due to plugin not providing any access restrictions to the direct in which download files are uploaded. This makes it possible for unauthenticated attackers to access downloads that should be password protected by downloading them straight from the directory.
Rimedio: Update to version 3.3.07, or a newer patched version
CWE-552: Files or Directories Accessible to External Parties
Il produttore l’ha corretta in 3.3.04; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.03. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
Rimedio: Update to version 3.3.04, or a newer patched version
Il produttore l’ha corretta in 3.3.04; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Rimedio: Update to version 3.3.04, or a newer patched version
Il produttore l’ha corretta in 3.3.04; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
Rimedio: Update to version 3.3.04, or a newer patched version
Il produttore l’ha corretta in 3.3.03; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Rimedio: Update to version 3.3.03, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.3.00; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_login_form' shortcode in all versions up to, and including, 3.2.99 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.3.00, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.99; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Rimedio: Update to version 3.2.99, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.98; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.98, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.90; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.
Rimedio: Update to version 3.2.90, or a newer patched version
Il produttore l’ha corretta in 3.2.94; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes in all versions up to, and including, 3.2.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.94, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.87; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution.
Rimedio: Update to version 3.2.87, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.94; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.94, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.91; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.91, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.85; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.84 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.85, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.86; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.86, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.85; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).
Rimedio: Update to version 3.2.85, or a newer patched version
Il produttore l’ha corretta in 3.2.83; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to information Exposure in all versions up to, and including, 3.2.82. This is due to the plugin leaking the password to a protected file when it receives an invalid password. This makes it possible for unauthenticated attackers to gain access to protected files.
Rimedio: Update to version 3.2.83, or a newer patched version
Il produttore l’ha corretta in 3.2.71; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.71, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.71; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 3.2.7.0, due to insufficient validation of passwords on password protected files. This makes it possible for authenticated attackers, with access to the downloads area to create a password protected post which returns a master key, and then subsequently use that master key and original password to access any other password protected post.
Rimedio: Update to version 3.2.71, or a newer patched version
Il produttore l’ha corretta in 6.3.0; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.2.9 due to the plugin leaking the master key. This can allow unauthenticated attackers to retrieve the key and extract sensitive data contained in password protected package files.
Rimedio: Update to version 6.3.0, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 3.2.62; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 3.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.62, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.60; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘packages-shortcode-toolbar.php’, 'Shortcodes.php', and 'category-shortcode-toolbar.php' (in both 'src/Package/views/' and 'src/Category/views/') files in versions up to, and including, 3.2.59 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute if they can successfully trick a victim into clicking on a link.
Rimedio: Update to version 3.2.60, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.55; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 3.2.54 via the File Browser Root field. This makes it possible for administrator-level attackers to list and read arbitrary files and folders outside of the blog directory.
Rimedio: Update to version 3.2.55, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Il produttore l’ha corretta in 3.2.50; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Rimedio: Update to version 3.2.50, or a newer patched version
Il produttore l’ha corretta in 3.2.54; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['REQUEST_URI'] in an echo statement without appropriate escaping on the URL in versions up to, and including, 3.2.53. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Rimedio: Update to version 3.2.54, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.49; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.48. This is due to missing or incorrect nonce validation on the updateTemplateStatus function. This makes it possible for unauthenticated attackers to trigger setting changes forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 3.2.49, or a newer patched version
Il produttore l’ha corretta in 3.2.49; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.48. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to delete stats and clear the plugin's cache via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 3.2.49, or a newer patched version
Il produttore l’ha corretta in 3.2.50; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to IP Blocking Bypass in versions up to, and including, 3.2.49 due to the way the visitor's IP address is determined. This allows an unauthenticated attacker to spoof their IP address to obtain access to files that are protected by this functionality.
Rimedio: Update to version 3.2.50, or a newer patched version
Il produttore l’ha corretta in 3.2.51; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.
Rimedio: Update to version 3.2.51, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Il produttore l’ha corretta in 3.2.49; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ and 'label' parameters in versions up to, and including, 3.2.48 due to insufficient input sanitization and output escaping when setting lock options for downloadables. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 3.2.49, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.44; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting
Rimedio: Update to version 3.2.44, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.44; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via redirect parameter in versions up to, and including, 3.2.43 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Rimedio: Update to version 3.2.44, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.47; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.
Rimedio: Update to version 3.2.47, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.43; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.
Rimedio: Update to version 3.2.43, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.39; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager WordPress plugin before 3.2.39 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Rimedio: Update to version 3.2.39, or a newer patched version
Il produttore l’ha corretta in 3.2.35; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).
Rimedio: Update to version 3.2.35, or a newer patched version
Il produttore l’ha corretta in 3.2.34; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
Rimedio: Update to version 3.2.34, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Il produttore l’ha corretta in 3.2.22; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Rimedio: Update to version 3.2.22, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.16; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
Rimedio: Update to version 3.2.16, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.2.13; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.12. This is due to missing or incorrect nonce validation on the preview() function. This makes it possible for unauthenticated attackers to save the plugins email settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 3.2.13, or a newer patched version
Il produttore l’ha corretta in 3.1.25; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Rimedio: Update to version 3.1.25, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
Il produttore l’ha corretta in 3.1.25; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Rimedio: Update to version 3.1.25, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 3.1.22; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions before 3.1.22. This is due to missing or incorrect nonce validation on the pluginUpdate() and Privacy() functions. This makes it possible for unauthenticated attackers to arbitrarily modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 3.1.22, or a newer patched version
Il produttore l’ha corretta in 3.1.23; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to arbitrary asset manager usage in versions before 3.1.23. This is due to the same nonce being using for multiple AJAX actions. This makes it possible for authenticated attackers with low level privileges to reveal the nonce in pages available to them and use it to perform unauthorized actions.
Rimedio: Update to version 3.1.23, or a newer patched version
Il produttore l’ha corretta in 3.1.19; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpdm_admin_upload_file function in versions before 3.1.19. Dangerous extensions such as .php4 are not restricted. This makes it possible for authenticated attackers with Author-level privileges and above to upload arbitrary files on the affected sites server which may make remote code execution possible.
Rimedio: Update to version 3.1.19, or a newer patched version
CWE-434: Unrestricted Upload of File with Dangerous Type
Il produttore l’ha corretta in 3.1.18; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to unauthorized download duplication in versions up to, and including, 3.1.17. This is due to missing authorization and nonce validation on the duplicate() function. This makes it possible for unauthenticated attackers to duplicate any of a vulnerable sites downloads.
Rimedio: Update to version 3.1.18, or a newer patched version
Il produttore l’ha corretta in 2.9.97; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.9.96 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Rimedio: Update to version 2.9.97, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.9.94; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
Rimedio: Update to version 2.9.94, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.9.61; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.6. This is due to missing or incorrect nonce validation on the wpdm_install_addon function. This makes it possible for unauthenticated attackers to install malicious plugins and/or packages via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 2.9.61, or a newer patched version
Il produttore l’ha corretta in 2.9.51; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Rimedio: Update to version 2.9.51, or a newer patched version
Il produttore l’ha corretta in 2.9.50; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting parameter in versions up to, and including, 2.9.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Rimedio: Update to version 2.9.50, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.9.46; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The WordPress Download Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.45. This is due to missing or incorrect nonce validation on the request of saving settings. This makes it possible for unauthenticated attackers to modify administrative settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Rimedio: Update to version 2.9.46, or a newer patched version
Il produttore l’ha corretta in 2.8.8; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Directory Listing in versions up to, and including, 2.8.7. This is due to the 'wpdm_dir_tree()' function being called during the 'init' action. This makes it possible for unauthenticated attackers to read all of the files listed in that directory.
Rimedio: Update to version 2.8.8, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Il produttore l’ha corretta in 2.8.8; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.8.7. This is due to unchecked use of the extract() function which makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit user metadata, including their role.
Rimedio: Update to version 2.8.8, or a newer patched version
Il produttore l’ha corretta in 2.8.8; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the savePackage() function in versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to associate arbitrary files with posts and subsequently download those files causing sensitive information disclosure.
Rimedio: Update to version 2.8.8, or a newer patched version
Il produttore l’ha corretta in 2.7.95; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file name of the uploaded file in versions up to, and including, 2.7.95 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rimedio: Update to version 2.7.95, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.7.5; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.7.4 via the wpdm_ajax_call_exec() function. This allows unauthorized attackers to execute code on the server.
Rimedio: Update to version 2.7.5, or a newer patched version
Il produttore l’ha corretta in 2.7.3; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option.
Rimedio: Update to version 2.7.3, or a newer patched version
Il produttore l’ha corretta in 2.2.3; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Scripting via the 'cid' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Rimedio: Update to version 2.2.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.5.9; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.
Rimedio: Update to version 2.5.9, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Il produttore l’ha corretta in 2.5.9; quella versione non è ancora nel repository.
Nessuna versione di questo repository è interessata.
Dettagli
The Download Manager plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Rimedio: Update to version 2.5.9, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Dati sulle vulnerabilità: Wordfence Intelligence. Ogni bollettino rimanda alla sua scheda lì.
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
