CVE-2022-2101mediumCWE-79

CVE-2022-2101: medium-severity vulnerability in codename065 Download Manager

Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Download Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 1.1%
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
codename065 · Download Manager
Related CVEs — codename065 Download Manager

In the same product, most dangerous first.

CVE-2024-11740HIGHDownload Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.9%CVE-2022-2436HIGHDownload Manager <= 3.2.49 - Authenticated (Contributor+) PHAR DeserializationEPSS 1.8%CVE-2022-1985MEDIUMDownload Manager <= 3.2.42 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2025-3404HIGHDownload Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File DeletionEPSS 1.2%CVE-2025-1785MEDIUMDownload Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File OverwriteEPSS 0.7%CVE-2023-2305MEDIUMDownload Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%