W3 Eden Inc. Wordpress Download Manager vulnerabilities

4 vulnerabilities

Known vulnerabilities in W3 Eden Inc. Wordpress Download Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2021-34638w3 eden, inc.wordpress download manager+2
EPSS score
1.33%
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.8.8CVE-2021-34639w3 eden, inc.wordpress download manager+2
EPSS score
0.58%
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.6.1CVE-2017-2216w3 eden, inc.wordpress download manager+2
EPSS score
1.43%
Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.6.1CVE-2017-2217w3 eden, inc.wordpress download manager+2
EPSS score
1.48%
Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.