CVE-2019-15889: w3eden Download Manager

Medium severity, CVSS 6.1. EPSS: 11.4% chance of exploitation in the next 30 days.

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.

Affected products

• w3eden Download Manager: before 2.9.94 (fixed in 2.9.94)

Published 2019-09-03. Last modified 2026-06-17.