CVE-2024-5266 – The Download Manager Pro WordPress plugin has a... (How to Fix)

Q: What is the severity of CVE-2024-5266?

CVE-2024-5266 has a CVSS score of 6.4 (MEDIUM). The Download Manager Pro WordPress plugin has a stored XSS vulnerability in multiple shortcodes that allows authenticated attackers with contributor access or higher to inject malicious scripts. These scripts execute when users view pages containing the compromised shortcodes, potentially compromising visitor sessions or performing unauthorized actions. All WordPress sites using this plugin up to version 3.2.92 are affected.

📋 TL;DR

The Download Manager Pro WordPress plugin has a stored XSS vulnerability in multiple shortcodes that allows authenticated attackers with contributor access or higher to inject malicious scripts. These scripts execute when users view pages containing the compromised shortcodes, potentially compromising visitor sessions or performing unauthorized actions. All WordPress sites using this plugin up to version 3.2.92 are affected.

💻 Affected Systems

Products:

WordPress Download Manager Pro plugin

Versions: All versions up to and including 3.2.92

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with Download Manager Pro plugin enabled and at least one user with contributor-level access or higher.

📦 What is this software?

Download Manager by W3eden

View all CVEs affecting Download Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts that steal session cookies or perform limited unauthorized actions when users view affected pages.

🟢

If Mitigated

With proper input validation and output escaping, malicious scripts are neutralized and rendered harmless as text rather than executable code.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access (contributor or higher) and knowledge of vulnerable shortcodes. The vulnerability is in common WordPress functionality making exploitation straightforward for attackers with access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.93 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3096450/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Download Manager Pro' and click 'Update Now'. 4. Alternatively, download version 3.2.93+ from WordPress plugin repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable shortcodes

all

Remove or disable the wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes from all posts/pages

WordPress database query: UPDATE wp_posts SET post_content = REPLACE(post_content, '[wpdm_user_dashboard', '[disabled_wpdm_user_dashboard') WHERE post_content LIKE '%[wpdm_user_dashboard%';
Repeat for other vulnerable shortcodes

Restrict user roles

all

Temporarily remove contributor-level access from untrusted users

WordPress admin: Users → All Users → Edit user → Role → Change to Subscriber

🧯 If You Can't Patch

Immediately remove contributor and author access from all untrusted users
Implement web application firewall rules to block XSS payloads in shortcode attributes

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins → Download Manager Pro version. If version is 3.2.92 or lower, you are vulnerable.

Check Version:

WordPress: wp plugin list --name='download-manager' --field=version

Verify Fix Applied:

After updating, verify plugin version shows 3.2.93 or higher in WordPress plugins page.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WordPress admin-ajax.php with shortcode parameters
Multiple failed login attempts followed by successful contributor-level login
Posts/pages being modified by contributor-level users with script tags in content

Network Indicators:

HTTP requests containing malicious script payloads in shortcode attributes
Outbound connections to suspicious domains from your WordPress site

SIEM Query:

source="wordpress.log" AND ("wpdm_user_dashboard" OR "wpdm_package" OR "wpdm_packages" OR "wpdm_search_result" OR "wpdm_tag") AND ("<script" OR "javascript:" OR "onload=" OR "onerror=")

📊 Metadata

CVE ID: CVE-2024-5266

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: June 12, 2024

Last Updated: March 21, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-5266, you might also want to check these: