4.3
Moyenne
CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…
Description
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Download Manager 4.0 | 4.0.0 → < 7.5.9 | 7.5.9 |
Autres CVE de Download Manager
Les 19 CVE de Download Manager →
CVE-2026-86610
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before…
6.4
Moyenne
CVE-2026-86609
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its…
8.8
Élevée
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in…
5.4
Moyenne
CVE-2026-14235
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session…
7.5
Élevée