Not rated
CVE-2021-25069 The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before…
Description
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Download Manager 3.2 | earliest → < 3.2.34 | 3.2.34 |
References
- wpscan.com wpscan.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Timeline
- Published
- Last modified
Other CVEs of Download Manager
The 19 CVEs of Download Manager →
CVE-2026-86611
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…
4.3
Medium
CVE-2026-86610
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before…
6.4
Medium
CVE-2026-86609
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its…
8.8
High
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in…
5.4
Medium