Plugin Pulse Beta
← Pulse

Download Manager

by Shahjada · eCommerce

Also makes 5 other plugins · 103.1K+ installs across the portfolio →

Try it live ↗ wp.org ↗

This File Management & Digital Store plugin will help you to control file downloads & sell digital products from your WP site.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

B 80/100

no flags

Active installs

90K+

≈98K estimated

Momentum

+24%

downloads vs prior 30d

Biggest opportunity: Swap “ecommerce” and “document management” for “file downloads” and “manager”. “ecommerce” isn't earning its slot: you're not in the first 24 results for its own search. “file downloads” sits at #5 untagged, close enough for a declared tag to move it up. “document management” isn't earning its slot: it only gets you to #11. “manager” sits at #7 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.

See the detail → Get the free audit
How scoring works →
80 Health · B
Maintenance 100/100
Rating quality 79/100
Support 51/100
Security 75/100

80 health vs 71 average across 9,790 eCommerce plugins

90K+

Active installs

≈98K estimated

11.7M

Total downloads

since 2010 · 0.8% still active

4.1/5

Rating

1,006 reviews · +0.2/wk

+24%

133.7K

Downloads · 30d

category median +2%

Install conversion

How it's measured →

0.8%

of downloads still active

At least 90K of 11.7M lifetime downloads are still running, below its category: the median eCommerce plugin keeps 1.4%, across 5,168 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other eCommerce plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 45 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 1006 reviews

Read on wp.org ↗
5★
736 4★
44 3★
24 2★
33 1★
169

Details

Version
3.3.75
Last updated
2d ago
Added
2010-02-10 · 16 yrs old
Requires WP
5.3
Tested up to
7.1.4
Requires PHP
—
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

87 / 100

Excellent listing optimization

Most to gain: Support resolution

Update recency 100/100

Updated 2 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 82/100

4.1★ over 1,006 reviews, weighted for review count to 4.1★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 38/100

3 of 8 support threads resolved in the last 2 months

To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,491 days · wp.org + Plugin Pulse archive

+24% vs prior 30d
27.3K3 Nov 2026

30-day downloads

Rolling 30-day volume · peak 271.5K · peaks are release surges

133.7K3 Nov 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Download Manager · #462youDownload Monitor · #510Download Manager Add · #2815Document Library Lit · #3412

Rating trend

Star average over time · dips mark rough releases

4.13 Nov 2026

Health trend

Composite health score, snapshotted daily

803 Nov 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

1.5K3 Nov 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

45

releases in the last 12 months

2d ago

latest release · v3.3.75 · 1 Nov 2026

182

tagged releases on record

Recent releases

3.3.75 · 1 Nov 20263.3.74 · 26 Oct 20263.3.73 · 15 Oct 20263.3.72 · 2 Oct 20263.3.71 · 27 Sep 20263.3.70 · 23 Sep 20263.3.69 · 17 Sep 20263.3.68 · 21 Aug 20263.3.67 · 30 Jul 20263.3.66 · 16 Jul 20263.3.65 · 12 Jul 20263.3.64 · 12 Jul 20263.3.63 · 9 Jul 20263.3.62 · 2 Jul 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin · 72% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v3.3 72%
v3.2 17%
Older / other versions 11%

Estimated active installs

The public count shows “90K+”. Our estimate pins where the real number sits.

tracked estimate
90K–100K ≈98K

Crossed into this band yesterday and the previous band took 9.1 years to cross, so the real count is still just under 100K.

Install history since 6 Dec 2021

90K3 Nov 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ promise521
    4mo ago

    For a few days now, I have been dealing with Tahasin, due to problems on my site. This brother has been great. Keep it up brother. I wish I could rate your service 10 stars. thanks again Download Manager. You are a great company to work with.

    Read on wp.org ↗
  2. ★★★★★ gorkova
    5mo ago

    Very kind and hardworking people, and the helpful support is excellent and very efficient.

    Read on wp.org ↗
  3. ★★★★★ Fred
    6mo ago

    Great plugin and excellent support!

    Read on wp.org ↗
  4. ★★★★★ purepixels
    6mo ago

    This plugin is perfect. It improved a lot over the last few years. We use it already for almost 10 years and we’ve seen the whole product and interface improve over the years. Everything you might need from a download manager is in there. And, if you ever run into issues or you have questions, the support (via chat and email) is very quick to help you out. We love this plugin. The Pro version is highly recommended !

    Read on wp.org ↗
  5. ★★★★★ jds2mpo
    7mo ago

    Great Support on a few occasions

    Read on wp.org ↗
  6. ★★★★★ Furkan Özden
    7mo ago

    Eklenti harika. Çeviri kısmının incelenmesi gerek. Örneğin page-template-default.php içinde [txt=Download][download_count]yer alan kısımda hata var. [txt=Download] yazması lazım. Kendi Türkçe çevirinizi yapabiliyorsunuz. Keşke sisteme yükleyip kullanıcılarla ilerleyen bir çeviri modülü olsa. Bu şekiled her güncelleme sonrası yedek aldığım çeviri dosyasını yüklemem gerekiyor. Son güncelleme ile eklenen Glassmorphism Card teması sayfa yükleme hızını büyük ölçüde yavaşlatıyor. Bulunan temalar yeterliydi.

    Read on wp.org ↗
  7. ★★★★★ cesare1360
    7mo ago

    RISOLTO…Uaoooo….!!!Innanzitutto complimenti perché siete velocissimi a rispondere.Vi ringrazio vivamente per avermi illuminato sull’errore che stavo facendo e quindi di configurare bene le chiavi. Io mi sono perso sulle varie soluzioni che ti propone la console di google mentre era tutto molto più semplice.Siete unici! Siete avanti!!!

    Read on wp.org ↗
  8. ★★★★★ vickyh
    8mo ago

    I’m using the free version of the plugin and have had a couple of issues recently. I posted my question on their forum and on both occasions they came back really quickly with answers and solutions. Very impressed with this level of support, especially as I’m only using the free version.

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. — Version 3.3.66 Security: Author+ Stored Cross-Site Scripting via Package Title – the title was run through stripcslashes() when rendered, which decoded C-style escape sequences back into active markup after save-time sanitization had a 3.3.66
  2. — Version 3.3.65 Fixed: The [wpdm_changelog] shortcode rendered unstyled, because its markup was emitted without the wrapper element that the front-end stylesheet scopes every changelog rule to 3.3.65
  3. — Version 3.3.64 Fixed: The [changelog] template tag rendered unstyled, because the front-end stylesheet still targeted an older markup structure – entry content was hidden outright, the timeline had no layout and the icons rendered at t 3.3.64
  4. — Version 3.3.63 New: Activity Reports – scheduled weekly or monthly summary emails covering downloads, top packages, trending items, user activity, category breakdown and storage usage, with configurable sections, recipients, schedule a 3.3.63
  5. — Version 3.3.62 Improved: Expirable download link handling Improved: Emailed and shareable download links are now kept in a durable, indexed store instead of post meta, so they survive cache clears and no longer bloat package meta Impro 3.3.62
  6. — Version 3.3.61 Fixed: Authenticated (Contributor+) Stored Cross-Site Scripting via the no_data_msg attribute of the wpdm_all_packages shortcode ( Reported by Wordfence ) 3.3.61

Security history

via Wordfence Intelligence

All 91 disclosed vulnerabilities are patched in the current version (3.3.75). Sites still on an older version should update.

  1. Patched Medium · 4.3 Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery ↗
    2026-10-19 CVE-2026-86611 Cross-Site Request Forgery Affects <= 3.3.70 Patched in 3.3.71
  2. Patched Medium · 6.1 Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter ↗
    2026-10-09 CVE-2026-12054 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.57 Patched in 3.3.58
  3. Patched Medium · 6.4 Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode ↗
    2026-10-09 CVE-2026-9696 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.58 Patched in 3.3.59
  4. Patched Medium · 4.3 Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email ↗
    2026-10-09 CVE-2026-103964 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.71 Patched in 3.3.72
  5. Patched Medium · 6.4 Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute ↗
    2026-10-09 CVE-2026-102401 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.71 Patched in 3.3.72
  6. Patched Medium · 5.3 Download Manager <= 3.3.70 - Unauthenticated Information Exposure ↗
    2026-10-02 CVE-2026-94405 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.70 Patched in 3.3.71
  7. Patched Medium · 6.4 Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name ↗
    2026-10-01 CVE-2026-97338 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.70 Patched in 3.3.71
  8. Patched Medium · 6.5 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter ↗
    2026-09-17 CVE-2026-92714 Authorization Bypass Through User-Controlled Key Affects <= 3.3.68 Patched in 3.3.69
  9. Patched High · 7.2 Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-08-05 CVE-2026-14292 Improper Neutralization of Input During Web Page Generation Affects < 3.3.66 Patched in 3.3.66
  10. Patched Medium · 6.4 Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute ↗
    2026-07-31 CVE-2026-16685 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.66 Patched in 3.3.67
  11. Patched Medium · 6.4 Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes ↗
    2026-07-08 CVE-2026-14343 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.61 Patched in 3.3.62
  12. Patched Medium · 6.4 Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute ↗
    2026-06-30 CVE-2026-13733 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.60 Patched in 3.3.61
  13. Patched Medium · 4.3 Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal ↗
    2026-04-09 CVE-2026-4057 Missing Authorization Affects <= 3.3.51 Patched in 3.3.52
  14. Patched Medium · 6.4 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2026-04-08 CVE-2026-5357 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.52 Patched in 3.3.53
  15. Patched Medium · 4.3 Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter ↗
    2026-03-18 CVE-2026-2571 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.49 Patched in 3.3.50
  16. Patched Medium · 5.3 Download Manager <= 3.3.52 - Missing Authorization ↗
    2026-02-19 CVE-2026-39676 Missing Authorization Affects <= 3.3.52 Patched in 3.3.53
  17. Patched Medium · 6.1 Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter ↗
    2026-02-17 CVE-2026-1666 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.46 Patched in 3.3.47
  18. Patched Medium · 6.4 Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2026-02-10 CVE-2026-39615 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.53 Patched in 3.3.54
  19. Patched High · 7.3 Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword ↗
    2026-01-05 CVE-2025-15364 Missing Support for Integrity Check Affects <= 3.3.40 Patched in 3.3.41
  20. Patched Medium · 4.3 Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure ↗
    2025-12-17 CVE-2025-13498 Missing Authorization Affects <= 3.3.32 Patched in 3.3.33
  21. Patched Medium · 5.3 Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key ↗
    2025-11-07 CVE-2025-12177 Use of Hard-coded Cryptographic Key Affects <= 3.3.30 Patched in 3.3.31
  22. Patched Medium · 4.3 Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure ↗
    2025-09-30 CVE-2025-63070 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.32 Patched in 3.3.33
  23. Patched Medium · 5.3 Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure ↗
    2025-09-26 CVE-2025-60092 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.25 Patched in 3.3.26
  24. Patched Medium · 4.3 Download Manager <= 3.3.24 - Cross-Site Request Forgery ↗
    2025-09-26 CVE-2025-60093 Cross-Site Request Forgery Affects <= 3.3.24 Patched in 3.3.25
  25. Patched Medium · 6.1 Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter ↗
    2025-09-18 CVE-2025-10146 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.23 Patched in 3.3.24
  26. Patched Medium · 6.4 Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode ↗
    2025-06-18 CVE-2025-4367 Improper Neutralization of Script-Related HTML Tags in a Web Page Affects <= 3.3.18 Patched in 3.3.19
  27. Patched High · 8.8 Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion ↗
    2025-04-18 CVE-2025-3404 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.3.12 Patched in 3.3.13
  28. Patched Medium · 5.4 Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ↗
    2025-04-17 CVE-2025-3056 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.12 Patched in 3.3.13
  29. Patched Medium · 5.4 Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite ↗
    2025-03-12 CVE-2025-1785 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.3.08 Patched in 3.3.09
  30. Patched Medium · 5.3 Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory ↗
    2025-01-17 CVE-2024-13126 Files or Directories Accessible to External Parties Affects <= 3.3.06 Patched in 3.3.07
  31. Patched Medium · 4.3 Download Manager <= 3.3.03 - Missing Authorization ↗
    2024-12-19 CVE-2024-56217 Missing Authorization Affects <= 3.3.03 Patched in 3.3.04
  32. Patched High · 7.3 Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution ↗
    2024-12-18 CVE-2024-11740 Improper Control of Generation of Code Affects <= 3.3.03 Patched in 3.3.04
  33. Patched Medium · 5.3 Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files ↗
    2024-12-18 CVE-2024-11768 Improper Authorization Affects <= 3.3.03 Patched in 3.3.04
  34. Patched Medium · 4.4 Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-11-29 CVE-2024-10706 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.02 Patched in 3.3.03
  35. Patched Medium · 6.4 Download Manager <= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-10-09 CVE-2024-8444 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.99 Patched in 3.3.00
  36. Patched Medium · 4.4 Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-09-23 CVE-2024-8284 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.98 Patched in 3.2.99
  37. Patched Medium · 6.4 Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-07-30 CVE-2024-6208 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.97 Patched in 3.2.98
  38. Patched High · 7.5 Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary ↗
    2024-06-12 CVE-2024-2098 Authentication Bypass by Alternate Name Affects <= 3.2.89 Patched in 3.2.90
  39. Patched Medium · 6.4 Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes ↗
    2024-06-11 CVE-2024-5266 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.92 Patched in 3.2.94
  40. Patched Medium · 4.4 Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting ↗
    2024-06-11 CVE-2024-1766 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.86 Patched in 3.2.87
  41. Patched Medium · 6.4 Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode ↗
    2024-06-04 CVE-2024-4001 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.93 Patched in 3.2.94
  42. Patched Medium · 6.4 Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode ↗
    2024-05-30 CVE-2024-4160 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.90 Patched in 3.2.91
  43. Patched Medium · 6.4 Download Manager <= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-16 CVE-2024-29114 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.84 Patched in 3.2.85
  44. Patched Medium · 6.4 Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-02-28 CVE-2023-6954 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.85 Patched in 3.2.86
  45. Patched Medium · 5.3 Download Manager <= 3.2.84 - Missing Authorization ↗
    2024-02-28 CVE-2023-6785 Improper Access Control Affects <= 3.2.84 Patched in 3.2.85
  46. Patched Medium · 5.3 Download Manager <= 3.2.82 - Unauthenticated Password Leak ↗
    2023-11-29 CVE-2023-6421 Incorrect Authorization Affects <= 3.2.82 Patched in 3.2.83
  47. Patched Medium · 6.4 Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-05-12 CVE-2023-2305 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.70 Patched in 3.2.71
  48. Patched Medium · 4.3 Download Manager <= 3.2.70 - Insufficient Authorization to Information Disclosure ↗
    2023-05-08 CVE-2023-1524 Improper Authorization Affects <= 3.2.70 Patched in 3.2.71
  49. Patched Medium · 5.3 Download Manager Pro <= 6.2.9 - Unauthenticated Information Disclosure ↗
    2023-04-10 CVE-2023-1809 Exposure of Sensitive Information to an Unauthorized Actor Affects 4.0 - 6.3.0 Patched in 6.3.0
  50. Patched Medium · 6.4 Download Manager <= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2022-12-20 CVE-2022-4476 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.61 Patched in 3.2.62
  51. Patched Medium · 6.1 Download Manager <= 3.2.59 - Refleced Cross-Site Scripting ↗
    2022-11-29 CVE-2022-45836 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.59 Patched in 3.2.60
  52. Patched Medium · 4.9 Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal ↗
    2022-09-05 CVE-2022-2926 Improper Limitation of a Pathname to a Restricted Directory Affects < 3.2.55 Patched in 3.2.55
  53. Patched High · 8.8 Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization ↗
    2022-08-17 CVE-2022-2436 Deserialization of Untrusted Data Affects <= 3.2.49 Patched in 3.2.50
  54. Patched Medium · 6.1 Download Manager <= 3.2.53 - Reflected Cross-Site Scripting ↗
    2022-08-04 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.53 Patched in 3.2.54
  55. Patched High · 8.8 Download Manager <= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update ↗
    2022-08-02 CVE-2022-34347 Cross-Site Request Forgery Affects <= 3.2.48 Patched in 3.2.49
  56. Patched High · 8.8 Download Manager <= 3.2.48 - Cross-Site Request Forgery ↗
    2022-08-02 CVE-2022-36288 Cross-Site Request Forgery Affects <= 3.2.48 Patched in 3.2.49
  57. Patched Medium · 5.3 Download Manager <= 3.2.49 - IP Blocking Bypass ↗
    2022-08-01 CVE-2022-2362 Authentication Bypass by Spoofing Affects <= 3.2.49 Patched in 3.2.50
  58. Patched High · 8.8 Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion ↗
    2022-07-27 CVE-2022-2431 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.2.50 Patched in 3.2.51
  59. Patched Medium · 5.4 Download Manager <= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2022-07-06 CVE-2022-34658 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.48 Patched in 3.2.49
  60. Patched Medium · 6.1 Download Manager <= 3.2.43 - Reflected Cross-Site Scripting ↗
    2022-06-27 CVE-2022-2168 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.43 Patched in 3.2.44
  61. Patched Medium · 6.1 Download Manager <= 3.2.43 - Reflected Cross-Site Scripting ↗
    2022-06-23 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.43 Patched in 3.2.44
  62. Patched Medium · 6.4 Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting ↗
    2022-06-21 CVE-2022-2101 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.46 Patched in 3.2.47
  63. Patched Medium · 6.1 Download Manager <= 3.2.42 - Reflected Cross-Site Scripting ↗
    2022-06-02 CVE-2022-1985 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.42 Patched in 3.2.43
  64. Patched High · 7.5 Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key ↗
    2022-03-16 CVE-2022-0828 Inadequate Encryption Strength Affects < 3.2.39 Patched in 3.2.39
  65. Patched High · 7.5 Download Manager <= 3.2.34 - Sensitive Information Disclosure ↗
    2022-02-02 CVE-2021-25087 Improper Access Control Affects < 3.2.35 Patched in 3.2.35
  66. Patched High · 8.8 WordPress Download Manager <= 3.2.33 - Authenticated SQL Injection ↗
    2022-01-20 CVE-2021-25069 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.2.34 Patched in 3.2.34
  67. Patched Medium · 6.4 WordPress Download Manager <= 3.2.21 - Cross-Site Scripting ↗
    2021-11-29 CVE-2021-24969 Improper Neutralization of Input During Web Page Generation Affects < 3.2.22 Patched in 3.2.22
  68. Patched Medium · 5.5 WordPress Download Manager <= 3.2.15 - Cross-Site Scripting ↗
    2021-09-29 CVE-2021-24773 Improper Neutralization of Input During Web Page Generation Affects < 3.2.16 Patched in 3.2.16
  69. Patched High · 7.1 WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery ↗
    2021-08-09 Cross-Site Request Forgery Affects < 3.2.13 Patched in 3.2.13
  70. Patched High · 7.5 WordPress Download Manager <= 3.1.24 - Authenticated File Upload ↗
    2021-07-29 CVE-2021-34639 Unrestricted Upload of File with Dangerous Type Affects <= 3.1.24 Patched in 3.1.25
  71. Patched Medium · 6.5 WordPress Download Manager <= 3.1.24 - Cross-Site Scripting ↗
    2021-07-29 CVE-2021-34638 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.24 Patched in 3.1.25
  72. Patched High · 8.8 WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery ↗
    2021-04-30 Cross-Site Request Forgery Affects < 3.1.22 Patched in 3.1.22
  73. Patched Medium · 6.3 WordPress Download Manager < 3.1.23 - Arbitrary Asset Manager Usage ↗
    2021-04-30 Missing Authorization Affects < 3.1.23 Patched in 3.1.23
  74. Patched High · 8.8 WordPress Download Manager < 3.1.19 - Arbitrary File Upload ↗
    2021-04-30 Unrestricted Upload of File with Dangerous Type Affects < 3.1.19 Patched in 3.1.19
  75. Patched Medium · 5.3 Download Manager <= 3.1.17 - Missing Authorization ↗
    2021-04-16 Missing Authorization Affects < 3.1.18 Patched in 3.1.18
  76. Patched Medium · 6.1 WordPress Download Manager <= 2.9.96 - Cross-Site Scripting ↗
    2019-06-16 Improper Neutralization of Input During Web Page Generation Affects < 2.9.97 Patched in 2.9.97
  77. Patched Medium · 6.1 WordPress Download Manager <= 2.9.93 - Cross-Site Scripting ↗
    2019-04-13 CVE-2019-15889 Improper Neutralization of Input During Web Page Generation Affects < 2.9.94 Patched in 2.9.94
  78. Patched Medium · 6.3 WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery ↗
    2018-01-09 Cross-Site Request Forgery Affects <= 2.9.6 Patched in 2.9.61
  79. Patched Medium · 6.1 WordPress Download Manager < 2.9.51 - Open Redirect ↗
    2017-07-13 CVE-2017-2217 URL Redirection to Untrusted Site Affects < 2.9.51 Patched in 2.9.51
  80. Patched Medium · 6.1 WordPress Download Manager <= 2.9.51 - Cross-Site Scripting ↗
    2017-06-16 CVE-2017-18032 Improper Neutralization of Input During Web Page Generation Affects <= 2.9.51 Patched in 2.9.52
  81. Patched Medium · 6.1 WordPress Download Manager <= 2.9.49 - Reflected Cross-Site Scripting ↗
    2017-06-13 CVE-2017-2216 Improper Neutralization of Input During Web Page Generation Affects < 2.9.50 Patched in 2.9.50
  82. Patched High · 8.8 WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery ↗
    2017-03-01 Cross-Site Request Forgery Affects <= 2.9.45 Patched in 2.9.46
  83. Patched Medium · 5.3 Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing ↗
    2016-01-19 Exposure of Sensitive Information to an Unauthorized Actor Affects < 2.8.8 Patched in 2.8.8
  84. Patched Medium · 6.5 Download Manager <= 2.8.7 - Privilege Escalation ↗
    2016-01-19 Improper Privilege Management Affects < 2.8.8 Patched in 2.8.8
  85. Patched Critical · 9.1 Download Manager <= 2.8.7 - Missing Authorization ↗
    2016-01-19 Missing Authorization Affects < 2.8.8 Patched in 2.8.8
  86. Patched Medium · 6.4 WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting ↗
    2015-07-16 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.94 Patched in 2.7.95
  87. Patched Critical · 9.8 WordPress Download Manager <= 2.7.4 - Remote Code Execution ↗
    2014-12-15 Improper Control of Generation of Code Affects < 2.7.5 Patched in 2.7.5
  88. Patched High · 8.1 WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update ↗
    2014-11-24 CVE-2014-9260 Missing Authorization Affects < 2.7.3 Patched in 2.7.3
  89. Patched Medium · 6.1 Download Manager <= 2.2.2 - Cross-Site Scripting ↗
    2014-08-01 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.2 Patched in 2.2.3
  90. Patched High · 7.2 Download Manager < 2.5.9 - Stored Cross-Site Scripting ↗
    2013-12-08 CVE-2013-7319 Improper Neutralization of Input During Web Page Generation Affects <= 2.5.8 Patched in 2.5.9
  91. Patched Medium · 5.3 Download Manager <= 2.5.8 - Cross-Site Scripting ↗
    2013-12-07 Improper Neutralization of Input During Web Page Generation Affects <= 2.5.8 Patched in 2.5.9

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Languages

via translate.wordpress.org

Translated into 40 languages, 5 at 90% or more

Galician 100%
Serbian 100%
Dutch 91%
Dutch (Formal) 91%
English (UK) 90%
French (France) 76%
Japanese 60%
Russian 57%
Swedish 55%
Polish 52%
Italian 51%
Spanish (Spain) 50%
Spanish (Chile) 48%
Ukrainian 46%
Catalan 44%
Greek 44%
Spanish (Colombia) 44%
Spanish (Ecuador) 44%
Spanish (Venezuela) 44%
Korean 43%
German (Formal) 39%
Turkish 36%
German 33%
Spanish (Mexico) 33%

Plus 16 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

This plugin’s searches fall outside the topics measured so far. See the topics measured so far.

Readme readiness

5 of 8 pass · checked 28 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ✓ Says what it does "This File Management & Digital Store plugin will help you to control file downloads & sell digital products..."
  • ! Has a FAQ No FAQ section.
  • ! FAQ asks real questions No FAQ to judge.
  • ! Names who it is for One audience phrase ("if you need"); say who the plugin is for and what they use it for.
  • ✓ Names what it works with Mentions Elementor, Gutenberg, PayPal, Dropbox and 2 more.
  • ✓ Headings and lists 16 headings and 13 lists.
  • ✓ Enough to quote 8,666 characters of description.
  • ✓ Tags match the text 4 of 5 tags appear in the text; "document management" does not.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2026-11-02 100K+ → 90K+ down after 3316 days in tier
  2. 2017-10-04 90K+ → 100K+ up after 279 days in tier
  3. 2016-12-29 80K+ → 90K+ up after 441 days in tier
  4. 2015-10-15 70K+ → 80K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Download Manager into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/download-manager" width="480" height="300" style="border:0" loading="lazy" title="Download Manager — Plugin Pulse"></iframe>
Preview card ↗

Download Manager: 90K+ active installs, 4.1★ (1,006 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/download-manager

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.