CVE-2017-18032: w3eden Download Manager

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.

Affected products

• w3eden Download Manager: before 2.9.52 (fixed in 2.9.52)

Published 2018-01-16. Last modified 2026-06-17.