WP-DownloadManager

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ captkirk1001

   1.1y ago

   The plugin is way too complex for an average user. The protection for download takes too many steps. I found not ever get the preview option only to display. I ask for a refund within the first 14 days after 13 messages from support. They refused. The free version does not have enough features to validate that the extra features are worth the money

   Read on wp.org ↗
2. ★★★★★ vectogravic

   2.0y ago

   This is what i was looking for. Works great with external file

   Read on wp.org ↗
3. ★★★★★ p4ssc3

   3.8y ago

   Très bon plugin / Very great plugin

   Read on wp.org ↗
4. ★★★★★ bertrand002

   4.6y ago

   I change my rating because it refers to another plugin. This topic was modified 4 years, 5 months ago by bertrand002.

   Read on wp.org ↗
5. ★★★★★ rytiskat

   5.4y ago

   NOT ONLY THAT THEY DID NOT REFUND THE MONEY THAT THEY WERE LEGALLY OBLIGATED TO DO DURING 14DAYS PERIOD AFTER PURCHASING, AFTER THEIR PLUGINS HAD PROBLEMS TO FUNCTION, THEY asked for logins to fix it and they messed the whole website up. Will never do business again with them they just take your money and run away, Plugins are coded by idiots, it’s impossible to combine it to modern plugins or themes, they keep telling you to buy more plugins to make it work as it should. Seriously stay away from them. This topic was modified 5 years, 3 months ago by rytiskat.

   Read on wp.org ↗
6. ★★★★★ chicho1969

   5.8y ago

   there is not support. After a month still waiting for support. This topic was modified 5 years, 7 months ago by chicho1969.

   Read on wp.org ↗
7. ★★★★★ MikeBav

   6.3y ago

   Lightweight plugin that does exactly what it says. Shortcodes and Templates are very customisable. Remember to create a folder and upload your files via FTP first, then update Permalinks. After that works perfectly.

   Read on wp.org ↗
8. ★★★★★ moein

   6.3y ago

   Excellent This is the lightest and most efficient download plugin Be sure to use this plugin

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.69.1 FIXED: Use file_id to fetch file again before deleting files. FIXED: Don’t allow directory traversal for download_path 1.69.1
2. — Version 1.69 FIXED: Only allow certain files to be uploaded based on wp_check_filetype_and_ext() 1.69
3. — Version 1.68.12 FIXED: Add a warning to let user know that if any users manage to guess the direct file URI, he will be able to download the file as well. 1.68.12
4. — Version 1.68.11 FIXED: Ensure that Download Path starts only with your wp-content folder for additional security. 1.68.11
5. — Version 1.68.10 FIXED: Allow form in Download Page Footer template. 1.68.10
6. — Version 1.68.9 FIXED: XSS file_sortby and file_sortorder in download-manager.php 1.68.9

10 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.5 WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter ↗
   2026-02-17 CVE-2026-2426 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.69 Patched in 1.69.1
2. Low · 2.7 WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter ↗
   2026-02-17 CVE-2026-2419 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.69 Patched in 1.69.1
3. High · 7.2 WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload ↗
   2025-09-25 CVE-2025-10747 Unrestricted Upload of File with Dangerous Type Affects <= 1.68.11 Patched in 1.69
4. Medium · 4.9 WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read ↗
   2025-06-10 CVE-2025-4798 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.68.10 Patched in 1.68.11
5. High · 7.2 WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion ↗
   2025-06-10 CVE-2025-4799 Absolute Path Traversal Affects <= 1.68.10 Patched in 1.68.11
6. Medium · 6.1 WP-DownloadManager <= 1.68.8 - Reflected Cross-Site Scripting ↗
   2024-09-27 CVE-2024-47341 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.68.8 Patched in 1.68.9
7. Medium · 4.8 WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting ↗
   2022-01-12 CVE-2022-25605 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.68.7 Patched in 1.68.7
8. Medium · 4.8 WP-DownloadManager <= 1.68.6 - Stored Cross-Site Scripting ↗
   2022-01-10 CVE-2022-25606 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.68.7 Patched in 1.68.7
9. Medium · 4.8 WP-DownloadManager plugin <= 1.68.6 - Reflected Cross-Site Scripting ↗
   2021-12-28 CVE-2021-44760 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.68.6 Patched in 1.68.7
10. Medium · 5.3 WP-DownloadManager <= 1.68.4 - Server-Side Request Forgery ↗
    2021-04-13 CVE-2020-24141 Server-Side Request Forgery (SSRF) Affects < 1.68.5 Patched in 1.68.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 68 languages, 1 at 90% or more

Plus 44 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-10-20 4K+ → 3K+ down after 1 days in tier
2. 2024-10-19 3K+ → 4K+ up after 1 days in tier
3. 2024-10-18 4K+ → 3K+ down after 515 days in tier
4. 2023-05-22 5K+ → 4K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Download Attachments 8K+ installs · 4.4★ · 3 shared tags A
• m1.DownloadList 400+ installs · 4.4★ · 3 shared tags A
• D Download Manager MS 10+ installs · 3.3★ · 3 shared tags F
• Simple Download Monitor 20K+ installs · 4.6★ · 2 shared tags A
• Easy Media Download 9K+ installs · 4.0★ · 2 shared tags B
• Media Library Downloader 4K+ installs · 4.2★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for WP-DownloadManager into a readme, a review or a deck. It updates itself.

WP-DownloadManager: 3K+ active installs, 4.0★ (37 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/wp-downloadmanager