# cve.now: Codename065

The newest entries naming Codename065 as an affected vendor (up to 200), of 50 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119156](https://cve.now/CVE-2026-119156.md): Download Manager \<= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP\_Error-as-ID) via Spotlight Template… (CVSS 7.2)
- [CVE-2026-110664](https://cve.now/CVE-2026-110664.md): Premium Packages \<= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes (CVSS 6.4)
- [CVE-2026-18586](https://cve.now/CVE-2026-18586.md): Premium Packages \<= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order\_email' (CVSS 7.2)
- [CVE-2026-103478](https://cve.now/CVE-2026-103478.md): Premium Packages \<= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout\[billing\]\[phone\]' Parameter (CVSS 6.4)
- [CVE-2026-12054](https://cve.now/CVE-2026-12054.md): Download Manager \<= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter (CVSS 6.1)
- [CVE-2026-9696](https://cve.now/CVE-2026-9696.md): Download Manager \<= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm\_packages Shortcode (CVSS 6.4)
- [CVE-2026-103964](https://cve.now/CVE-2026-103964.md): Download Manager \<= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first\_name' Profile Field Token Injection into Suspension Email (CVSS 4.3)
- [CVE-2026-102401](https://cve.now/CVE-2026-102401.md): Download Manager \<= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-97338](https://cve.now/CVE-2026-97338.md): Download Manager \<= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (CVSS 6.4)
- [CVE-2026-93654](https://cve.now/CVE-2026-93654.md): Premium Packages \<= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart\_items\[\]\[product\_name\]' Parameter (CVSS 7.2)
- [CVE-2026-92714](https://cve.now/CVE-2026-92714.md): Download Manager \<= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm\_duplicate' Parameter (CVSS 6.5)
- [CVE-2026-16685](https://cve.now/CVE-2026-16685.md): Download Manager \<= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-12800](https://cve.now/CVE-2026-12800.md): Premium Packages \<= 6.2.0 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2026-15348](https://cve.now/CVE-2026-15348.md): Premium Packages \<= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter (CVSS 6.3)
- [CVE-2026-15906](https://cve.now/CVE-2026-15906.md): Premium Packages \<= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter (CVSS 6.5)
- [CVE-2026-14343](https://cve.now/CVE-2026-14343.md): Download Manager \<= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note\_before' and 'note\_after' Shortcode Attributes (CVSS 6.4)
- [CVE-2026-13733](https://cve.now/CVE-2026-13733.md): Download Manager \<= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no\_data\_msg' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-4057](https://cve.now/CVE-2026-4057.md): Download Manager \<= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal (CVSS 4.3)
- [CVE-2026-5357](https://cve.now/CVE-2026-5357.md): Download Manager \<= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-2571](https://cve.now/CVE-2026-2571.md): Download Manager \<= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter (CVSS 4.3)
- [CVE-2026-1666](https://cve.now/CVE-2026-1666.md): Download Manager \<= 3.3.46 - Reflected Cross-Site Scripting via 'redirect\_to' Parameter (CVSS 6.1)
- [CVE-2025-15364](https://cve.now/CVE-2025-15364.md): Download Manager \<= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword (CVSS 7.3)
- [CVE-2025-13498](https://cve.now/CVE-2025-13498.md): Download Manager \<= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure (CVSS 4.3)
- [CVE-2025-12177](https://cve.now/CVE-2025-12177.md): Download Manager \<= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key (CVSS 5.3)
- [CVE-2025-10146](https://cve.now/CVE-2025-10146.md): Download Manager \<= 3.3.23 - Reflected Cross-Site Scripting via \`user\_ids\` Parameter (CVSS 6.1)
- [CVE-2025-4367](https://cve.now/CVE-2025-4367.md): Download Manager \<= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm\_user\_dashboard Shortcode (CVSS 6.4)
- [CVE-2025-3404](https://cve.now/CVE-2025-3404.md): Download Manager \<= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion (CVSS 8.8)
- [CVE-2025-3056](https://cve.now/CVE-2025-3056.md): Download Manager \<= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.4)
- [CVE-2025-1785](https://cve.now/CVE-2025-1785.md): Download Manager \<= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite (CVSS 5.4)
- [CVE-2024-11768](https://cve.now/CVE-2024-11768.md): Download manager \<= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files (CVSS 5.3)
- [CVE-2024-11740](https://cve.now/CVE-2024-11740.md): Download Manager \<= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-11225](https://cve.now/CVE-2024-11225.md): Premium Packages – Sell Digital Products Securely \<= 5.9.3 - Reflected Cross-Site Scripting via add\_query\_arg (CVSS 6.1)
- [CVE-2024-10164](https://cve.now/CVE-2024-10164.md): Premium Packages - Sell Digital Products Securely \<= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp\_pay\_link Shortcode (CVSS 6.4)
- [CVE-2024-7386](https://cve.now/CVE-2024-7386.md): Premium Packages – Sell Digital Products Securely \<= 5.9.1 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2024-7486](https://cve.now/CVE-2024-7486.md): MultiPurpose \<= 1.2.0 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8)
- [CVE-2024-7560](https://cve.now/CVE-2024-7560.md): News Flash \<= 1.1.0 - Authenticated (Editor+) PHP Object Injection (CVSS 7.2)
- [CVE-2024-6208](https://cve.now/CVE-2024-6208.md): Download Manager \<= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-2098](https://cve.now/CVE-2024-2098.md): Download Manager \<= 3.2.89 - Improper Authorization via protectMediaLibrary (CVSS 7.5)
- [CVE-2024-1766](https://cve.now/CVE-2024-1766.md): Download Manager \<= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-5266](https://cve.now/CVE-2024-5266.md): Download Manager \<= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4)
- [CVE-2024-4001](https://cve.now/CVE-2024-4001.md): Download Manager \<= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm\_modal\_login\_form Shortcode (CVSS 6.4)
- [CVE-2024-4160](https://cve.now/CVE-2024-4160.md): Download Manager \<= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode (CVSS 6.4)
- [CVE-2024-33938](https://cve.now/CVE-2024-33938.md): WordPress Sliding Widgets plugin \<= 1.5.0 - Broken Access Control to XSS vulnerability (CVSS 6.5)
- [CVE-2023-6785](https://cve.now/CVE-2023-6785.md): Download Manager \<= 3.2.84 - Missing Authorization (CVSS 5.3)
- [CVE-2023-6954](https://cve.now/CVE-2023-6954.md): Download Manager \<= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-4293](https://cve.now/CVE-2023-4293.md): Premium Packages - Sell Digital Products Securely \<= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2023-2305](https://cve.now/CVE-2023-2305.md): Download Manager \<= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2022-2436](https://cve.now/CVE-2022-2436.md): Download Manager \<= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization (CVSS 8.8)
- [CVE-2022-2101](https://cve.now/CVE-2022-2101.md): Download Manager \<= 3.2.46 - Contributor+ Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-1985](https://cve.now/CVE-2022-1985.md): Download Manager \<= 3.2.42 - Reflected Cross-Site Scripting (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/codename065
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.