Known vulnerabilities in Download Manager

This File Management & Digital Store plugin will help you to control file downloads & sell digital products from your WP site.

84Reported vulnerabilities

9.8Highest CVSS score

3.3.67Latest version

100,000+Active installs

What to do now

Update Download Manager to 3.3.66 or later. 83 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 30, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2019-15889	Medium 6.1	11.4%	Before 2.9.94	`2.9.94`	September 3, 2019
CVE-2022-2431	High 8.8	3.7%	3.2.50 and earlier	`3.2.51`	September 6, 2022
CVE-2014-9260	High 8.1	11.1%	Before 2.7.3	`2.7.3`	November 24, 2014
CVE-2023-6421	High 7.5	2.4%	0 up to (but not including) 3.2.83	`3.2.83`	January 1, 2024
CVE-2022-0828	High 7.5	1.5%	Before 3.2.34	`3.2.34`	April 11, 2022
CVE-2021-25087	High 7.5	1.5%	Before 3.2.35	`3.2.35`	March 7, 2022
CVE-2022-2362	High 7.5	1.1%	Before 3.2.50	`3.2.50`	August 22, 2022
CVE-2023-1809	High 7.5	0.7%	6.0.0 up to (but not including) 6.3.0	`6.3.0`	May 2, 2023
CVE-2023-1524	Medium 6.5	0.7%	0 up to (but not including) 3.2.71	`3.2.71`	May 30, 2023
CVE-2022-1985	Medium 6.1	1.2%	3.2.42 and earlier	`3.2.43`	June 13, 2022
CVE-2017-18032	Medium 6.1	0.9%	Before 2.9.52	`2.9.52`	January 16, 2018
CVE-2014-8585	Medium 5	2.9%	1.1 to 1.1 (inclusive) 1.2 to 1.2 (inclusive) 1.2.1 to 1.2.1 (inclusive) 1.2.2 to 1.2.2 (inclusive) 1.2.3 to 1.2.3 (inclusive) 1.2.4 to 1.2.4 (inclusive) 1.2.5 to 1.2.5 (inclusive) 1.3 to 1.3 (inclusive) 1.4 to 1.4 (inclusive) 1.5 to 1.5 (inclusive) 1.5.1 to 1.5.1 (inclusive) 1.5.2 to 1.5.2 (inclusive) 1.5.3 to 1.5.3 (inclusive) 1.5.9 to 1.5.9 (inclusive) 1.5.32 to 1.5.32 (inclusive) 1.5.33 to 1.5.33 (inclusive) 2.0.1 to 2.0.1 (inclusive) 2.0.2 to 2.0.2 (inclusive) 2.0.3 to 2.0.3 (inclusive) 2.0.4 to 2.0.4 (inclusive) 2.0.5 to 2.0.5 (inclusive) 2.0.6 to 2.0.6 (inclusive) 2.0.7 to 2.0.7 (inclusive) 2.0.8 to 2.0.8 (inclusive) 2.0.9 to 2.0.9 (inclusive) 2.0.10 to 2.0.10 (inclusive) 2.0.11 to 2.0.11 (inclusive) 2.0.12 to 2.0.12 (inclusive) 2.0.13 to 2.0.13 (inclusive) 2.0.14 to 2.0.14 (inclusive) 2.0.15 to 2.0.15 (inclusive) 2.0.16 to 2.0.16 (inclusive) 2.0.17 to 2.0.17 (inclusive) 2.0.18 to 2.0.18 (inclusive) 2.0.19 to 2.0.19 (inclusive) 2.1.0 to 2.1.0 (inclusive) 2.1.1 to 2.1.1 (inclusive) 2.1.2 to 2.1.2 (inclusive) 2.1.3 to 2.1.3 (inclusive) 2.2.0 to 2.2.0 (inclusive) 2.2.1 to 2.2.1 (inclusive) 2.2.2 to 2.2.2 (inclusive) 2.2.3 to 2.2.3 (inclusive) 2.2.4 to 2.2.4 (inclusive) 2.2.5 to 2.2.5 (inclusive) 2.2.6 to 2.2.6 (inclusive) 2.2.7 to 2.2.7 (inclusive) 2.2.8 to 2.2.8 (inclusive) 2.2.9 to 2.2.9 (inclusive) 2.3.0 to 2.3.0 (inclusive) 2.3.1 to 2.3.1 (inclusive) 2.3.2 to 2.3.2 (inclusive) 2.3.3 to 2.3.3 (inclusive) 2.3.4 to 2.3.4 (inclusive) 2.3.5 to 2.3.5 (inclusive) 2.3.6 to 2.3.6 (inclusive) 2.3.7 to 2.3.7 (inclusive) 2.3.8 to 2.3.8 (inclusive) 2.3.9 to 2.3.9 (inclusive) 2.4.0 to 2.4.0 (inclusive) 2.4.1 to 2.4.1 (inclusive) 2.4.2 to 2.4.2 (inclusive) 2.4.3 to 2.4.3 (inclusive) 2.4.4 to 2.4.4 (inclusive) 2.4.5 to 2.4.5 (inclusive) 2.4.6 to 2.4.6 (inclusive) 2.4.7 to 2.4.7 (inclusive) 2.4.8 to 2.4.8 (inclusive) 2.4.9 to 2.4.9 (inclusive) 2.5.0 to 2.5.0 (inclusive) 2.5.1 to 2.5.1 (inclusive) 2.5.2 to 2.5.2 (inclusive) 2.5.3 to 2.5.3 (inclusive) 2.5.4 to 2.5.4 (inclusive) 2.5.5 to 2.5.5 (inclusive) 2.5.6 to 2.5.6 (inclusive) 2.5.7 to 2.5.7 (inclusive) 2.5.8 to 2.5.8 (inclusive) 2.5.9 to 2.5.9 (inclusive) 2.5.91 to 2.5.91 (inclusive) 2.5.92 to 2.5.92 (inclusive) 2.5.93 to 2.5.93 (inclusive) 2.5.94 to 2.5.94 (inclusive) 2.5.95 to 2.5.95 (inclusive) 2.5.96 to 2.5.96 (inclusive) 2.5.97 to 2.5.97 (inclusive) 2.5.98 to 2.5.98 (inclusive) 2.5.99 to 2.5.99 (inclusive) 2.6.0 to 2.6.0 (inclusive) 2.6.1 to 2.6.1 (inclusive) 2.6.2 to 2.6.2 (inclusive) 2.6.3 to 2.6.3 (inclusive) 2.6.4 to 2.6.4 (inclusive) 2.6.5 to 2.6.5 (inclusive) 2.6.6 to 2.6.6 (inclusive) 2.6.7 to 2.6.7 (inclusive) 2.6.8 to 2.6.8 (inclusive) 2.6.9 to 2.6.9 (inclusive) 2.6.91 to 2.6.91 (inclusive) 2.6.92 to 2.6.92 (inclusive) 2.6.93 to 2.6.93 (inclusive) 2.6.94 to 2.6.94 (inclusive) 2.6.95 to 2.6.95 (inclusive) 2.6.96 to 2.6.96 (inclusive)	—	November 4, 2014
CVE-2021-24773	Medium 4.8	2.9%	Before 3.2.16	`3.2.16`	November 1, 2021
CVE-2022-2101	Medium 5.4	1.0%	3.2.46 and earlier	`3.2.47`	July 18, 2022
WF-5e491592-a17f-4789-8faa-d2a60b8ced70	Critical 9.8	—	Before 2.7.5	`2.7.5`	December 15, 2014
CVE-2023-2305	Medium 5.4	0.6%	Before 3.2.71	`3.2.71`	June 9, 2023
CVE-2022-4476	Medium 5.4	0.6%	Before 3.2.62	`3.2.62`	January 16, 2023
CVE-2022-2436	High 8.8	2.0%	Before 3.2.50	`3.2.50`	September 6, 2022
CVE-2021-24969	Medium 5.4	0.6%	Before 3.2.22	`3.2.22`	December 27, 2021
CVE-2021-25069	High 8.8	1.5%	Before 3.2.34	`3.2.34`	January 20, 2022
CVE-2025-3404	High 8.8	1.1%	0 to 3.3.12 (inclusive)	`3.3.13`	April 19, 2025
WF-d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0	Critical 9.1	—	Before 2.8.8	`2.8.8`	January 19, 2016
CVE-2022-36288	High 8.8	0.3%	3.2.48 and earlier	`3.2.49`	August 23, 2022
CVE-2022-34347	High 8.8	0.4%	3.2.48 and earlier	`3.2.49`	August 22, 2022
CVE-2021-34639	High 8.8	0.6%	3.1.24 and earlier	`3.1.25`	August 5, 2021
WF-4ccc8f3b-9028-45db-8db2-574736fe3ccb	High 8.8	—	Before 3.1.22	`3.1.22`	April 30, 2021
WF-ed40b874-68e2-49f3-95b0-653600394e78	High 8.8	—	Before 3.1.19	`3.1.19`	April 30, 2021
WF-f52aede5-21c3-46b9-800e-860a677a4b90	High 8.8	—	2.9.45 and earlier	`2.9.46`	March 1, 2017
CVE-2024-11740	High 7.3	1.9%	0 to 3.3.03 (inclusive)	`3.3.04`	December 19, 2024
CVE-2024-2098	High 7.5	0.5%	0 to 3.2.89 (inclusive)	`3.2.90`	June 13, 2024
CVE-2025-15364	High 7.3	0.2%	0 to 3.3.40 (inclusive)	`3.3.41`	January 6, 2026
CVE-2026-14292	High 7.2	0.2%	Before 3.3.66	`3.3.66`	August 5, 2026
WF-b0d8499a-a630-4c2b-9381-78ac83da119d	High 7.1	—	Before 3.2.13	`3.2.13`	August 9, 2021
CVE-2021-34638	Medium 6.5	1.3%	3.1.24 and earlier	`3.1.25`	August 5, 2021
CVE-2026-14343	Medium 6.4	0.3%	0 to 3.3.61 (inclusive)	`3.3.62`	July 9, 2026
CVE-2026-13733	Medium 6.4	0.4%	0 to 3.3.60 (inclusive)	`3.3.61`	July 1, 2026
CVE-2026-5357	Medium 6.4	0.3%	0 to 3.3.52 (inclusive)	`3.3.53`	April 9, 2026
CVE-2024-8444	Medium 6.4	0.3%	3.2.99 and earlier	`3.3.00`	October 9, 2024
CVE-2024-29114	Medium 6.4	0.3%	3.2.84 and earlier	`3.2.85`	March 16, 2024
CVE-2022-2168	Medium 6.1	1.3%	3.2.43 and earlier	`3.2.44`	June 27, 2022
CVE-2017-2217	Medium 6.1	1.5%	2.9.50 and earlier	`2.9.51`	July 7, 2017
CVE-2017-2216	Medium 6.1	1.4%	2.9.49 and earlier	`2.9.50`	July 7, 2017
WF-c59cddfb-c434-4a69-9c1c-7d58f022c1aa	Medium 6.5	—	Before 2.8.8	`2.8.8`	January 19, 2016
CVE-2026-16685	Medium 6.4	0.2%	0 to 3.3.66 (inclusive)	`3.3.67`	August 1, 2026
CVE-2026-39615	Medium 6.4	0.2%	3.3.53 and earlier	`3.3.54`	February 10, 2026
CVE-2022-45836	Medium 6.1	0.7%	3.2.59 and earlier	`3.2.60`	November 29, 2022
WF-6d700580-1374-4a17-a6b3-59ba1d063030	Medium 6.3	—	Before 3.1.23	`3.1.23`	April 30, 2021
WF-79b5883b-a3be-497e-b911-7dc39e7fb418	Medium 6.3	—	2.9.6 and earlier	`2.9.61`	January 9, 2018
WF-b3247bb3-3d9a-49b5-99ec-f4b305d37ae5	Medium 6.4	—	2.7.94 and earlier	`2.7.95`	July 16, 2015
CVE-2026-1666	Medium 6.1	0.3%	0 to 3.3.46 (inclusive)	`3.3.47`	February 18, 2026
CVE-2025-10146	Medium 6.1	0.2%	0 to 3.3.23 (inclusive)	`3.3.24`	September 19, 2025
WF-332b8d96-89b2-473b-9186-239e49f5b064	Medium 6.1	—	3.2.53 and earlier	`3.2.54`	August 4, 2022
WF-9d72604e-23ef-4a69-8839-cf8ff4aef3bc	Medium 6.1	—	3.2.43 and earlier	`3.2.44`	June 23, 2022
WF-cad5274f-0d73-425d-bdfb-478c77d55d6c	Medium 6.1	—	Before 2.9.97	`2.9.97`	June 16, 2019
WF-6a6390d2-58cd-468e-9936-e16954e2d3ee	Medium 6.1	—	2.2.2 and earlier	`2.2.3`	August 1, 2014
CVE-2013-7319	Medium 4.3	4.6%	2.5.8 and earlier 2.5.0 to 2.5.0 (inclusive) 2.5.1 to 2.5.1 (inclusive) 2.5.2 to 2.5.2 (inclusive) 2.5.3 to 2.5.3 (inclusive) 2.5.4 to 2.5.4 (inclusive) 2.5.5 to 2.5.5 (inclusive) 2.5.6 to 2.5.6 (inclusive) 2.5.7 to 2.5.7 (inclusive)	`2.5.9`	February 6, 2014
CVE-2025-3056	Medium 5.4	0.4%	0 to 3.3.12 (inclusive)	`3.3.13`	April 18, 2025
CVE-2025-1785	Medium 5.4	0.6%	3.3.08 and earlier	`3.3.09`	March 12, 2025
CVE-2024-6208	Medium 5.4	0.4%	0 to 3.2.97 (inclusive)	`3.2.98`	July 31, 2024
CVE-2024-1766	Medium 5.4	0.3%	0 to 3.2.86 (inclusive) 0 to 3.2.86 (inclusive)	`3.2.87`	June 12, 2024
CVE-2024-5266	Medium 5.4	0.4%	0 to 3.2.92 (inclusive)	`3.2.94`	June 12, 2024
CVE-2024-4001	Medium 5.4	0.3%	Before 3.2.94	`3.2.94`	June 5, 2024
CVE-2024-4160	Medium 5.4	0.3%	0 to 3.2.90 (inclusive)	`3.2.91`	May 31, 2024
CVE-2023-6954	Medium 5.4	0.5%	0 to 3.2.85 (inclusive)	`3.2.86`	March 13, 2024
CVE-2023-6785	Medium 5.3	0.5%	3.2.84 and earlier	`3.2.85`	February 28, 2024
CVE-2022-34658	Medium 5.4	0.6%	3.2.48 and earlier	`3.2.49`	August 23, 2022
CVE-2026-39676	Medium 5.3	0.2%	3.3.52 and earlier	`3.3.53`	February 19, 2026
CVE-2025-12177	Medium 5.3	0.2%	3.3.30 and earlier	`3.3.31`	November 7, 2025
CVE-2025-60092	Medium 5.3	0.3%	3.3.25 and earlier	`3.3.26`	September 26, 2025
CVE-2025-4367	Medium 5.4	0.2%	0 to 3.3.18 (inclusive)	`3.3.19`	June 19, 2025
CVE-2024-13126	Medium 5.3	0.5%	3.3.06 and earlier	`3.3.07`	January 17, 2025
CVE-2024-11768	Medium 5.3	0.3%	0 to 3.3.03 (inclusive)	`3.3.04`	December 19, 2024
CVE-2022-2926	Medium 4.9	1.5%	Before 3.2.55	`3.2.55`	September 5, 2022
WF-06738434-ccd4-4e87-8163-d56ff3b4b5c8	Medium 5.3	—	Before 3.1.18	`3.1.18`	April 16, 2021
WF-639bf20c-04d4-49e5-8da1-685421a6f63a	Medium 5.3	—	Before 2.8.8	`2.8.8`	January 19, 2016
WF-bd7c442f-5c91-4c52-933a-8a6fb7adca8c	Medium 5.3	—	2.5.8 and earlier	`2.5.9`	December 7, 2013
CVE-2024-10706	Medium 4.4	0.3%	3.3.02 and earlier	`3.3.03`	November 29, 2024
CVE-2024-8284	Medium 4.4	0.3%	3.2.98 and earlier	`3.2.99`	September 23, 2024
CVE-2026-4057	Medium 4.3	0.4%	0 to 3.3.51 (inclusive)	`3.3.52`	April 10, 2026
CVE-2026-2571	Medium 4.3	0.2%	0 to 3.3.49 (inclusive)	`3.3.50`	March 19, 2026
CVE-2025-13498	Medium 4.3	0.4%	0 to 3.3.32 (inclusive)	`3.3.33`	December 18, 2025
CVE-2025-63070	Medium 4.3	0.3%	3.3.32 and earlier	`3.3.33`	September 30, 2025
CVE-2025-60093	Medium 4.3	0.1%	3.3.24 and earlier	`3.3.25`	September 26, 2025
CVE-2024-56217	Medium 4.3	0.3%	3.3.03 and earlier	`3.3.04`	December 19, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.