CVE-2022-2168: w3eden Download Manager

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting

Affected products

• w3eden Download Manager: before 3.2.44 (fixed in 3.2.44)

Published 2022-07-17. Last modified 2026-06-17.