CVE-2024-4160 – This stored XSS vulnerability in WordPress Down... (How to Fix)

Q: What is the severity of CVE-2024-4160?

CVE-2024-4160 has a CVSS score of 6.4 (MEDIUM). This stored XSS vulnerability in WordPress Download Manager plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using Download Manager versions up to 3.2.90 are affected.

📋 TL;DR

This stored XSS vulnerability in WordPress Download Manager plugin allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using Download Manager versions up to 3.2.90 are affected.

💻 Affected Systems

Products:

WordPress Download Manager plugin

Versions: All versions up to and including 3.2.90

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with contributor role or higher; affects all WordPress installations using vulnerable plugin versions.

📦 What is this software?

Download Manager by W3eden

View all CVEs affecting Download Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect visitors to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user session cookies or credentials, potentially gaining administrative access to the WordPress site.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to potential defacement of specific pages without credential theft.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires contributor-level WordPress access; technical details and proof-of-concept are publicly available in vulnerability reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.91 and later

Vendor Advisory: https://wordpress.org/plugins/download-manager/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Download Manager plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 3.2.91+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Remove vulnerable shortcode usage

all

Remove or disable usage of the 'wpdm-all-packages' shortcode from all posts and pages

Restrict user roles

all

Limit contributor and author roles to trusted users only; review all user accounts with editing privileges

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution
Install web application firewall (WAF) with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins → Download Manager version. If version is 3.2.90 or lower, you are vulnerable.

Check Version:

wp plugin list --name=download-manager --field=version (if WP-CLI installed)

Verify Fix Applied:

After updating, verify Download Manager version shows 3.2.91 or higher in WordPress plugins list.

📡 Detection & Monitoring

Log Indicators:

Unusual post/page edits by contributor-level users
Suspicious script tags in post/page content containing 'wpdm-all-packages'

Network Indicators:

Unexpected JavaScript execution from WordPress pages
Suspicious outbound connections from user browsers after visiting specific pages

SIEM Query:

source="wordpress.log" AND ("wpdm-all-packages" OR "download-manager") AND ("post_modified" OR "updated_post")

📊 Metadata

CVE ID: CVE-2024-4160

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 31, 2024

Last Updated: March 21, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4160, you might also want to check these: