The Download Manager WordPress plugin before 7.5.6 has a Stored Cross-Site Scripting vulnerability in its email-locked download subscription form, affecting the commercial Pro edition. This allows unauthenticated attackers to perform XSS attacks against administrators. The vulnerability is particularly concerning as it requires no authentication or user interaction, making it a high-priority issue for adm [truncated]
The Download Manager WordPress plugin before 3.3.62 has a vulnerability that allows unauthorized access to role- or password-protected package files. This is due to the plugin's temporary download token not being bound to the requesting session and not expiring promptly. As a result, an attacker who obtains a leaked download key can repeatedly download protected files without authorization. Users of the p [truncated]
