Unknown Download Manager vulnerabilities

4 CVEs affecting Unknown Download Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86610, published 2026-10-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14235, published 2026-07-27. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable…
CVE-2026-86609, published 2026-09-27. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which…
CVE-2026-14292, published 2026-08-01. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to…
CVE-2026-86610, published 2026-10-01. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and…