Shahjada vulnerabilities and threats

18 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.2%	CVE-2026-94405Download Manager (WordPress plugin) · Insecure Direct Object Reference Medium5.3EPSS 0.2%2026-10-02CVE Database V5CVE-2026-94405 CVE-2026-94405 is an authorization bypass vulnerability in Shahjada Download Manager that allows an attacker to retrieve embedded sensitive data by exploiting a user-controlled key. The issue affects versions up to 3.3.71. The vulnerability has a CVSS score of 5.3, indicating medium severity, and does not require privileges or user interaction to exploit. EPSS 0.2%Vulnerability Shahjada CWE-639	CVE Database V5	2026-10-02
Critical	9.3	EPSS 0.4%	CVE-2026-61948WPDM (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-07-23CVE Database V5CVE-2026-61948 Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. EPSS 0.4%Vulnerability Shahjada CWE-89	CVE Database V5	2026-07-23
High	7.5	EPSS 0.4%	CVE-2026-61943WPDM (WordPress plugin) · Missing Authorization High7.5EPSS 0.4%2026-07-23CVE Database V5CVE-2026-61943 Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. EPSS 0.4%Vulnerability Shahjada CWE-862	CVE Database V5	2026-07-23
Medium	5.3	EPSS 0.2%	CVE-2026-39676Download Manager (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.2%2026-04-08CVE Database V5CVE-2026-39676 Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52. EPSS 0.2%Vulnerability Shahjada	CVE Database V5	2026-04-08
Medium	5.9	EPSS 0.2%	CVE-2026-39615Download Manager (WordPress plugin) · Cross-site Scripting Medium5.9EPSS 0.2%2026-04-08CVE Database V5CVE-2026-39615 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53. EPSS 0.2%Vulnerability Shahjada	CVE Database V5	2026-04-08
Critical	9.3	EPSS 0.3%	CVE-2026-24956Download Manager Addons for Elementor (WordPress plugin) · SQL Injection Critical9.3EPSS 0.3%2026-02-20CVE Database V5CVE-2026-24956 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0. EPSS 0.3%Vulnerability Shahjada	CVE Database V5	2026-02-20
High	7.1	EPSS 0.2%	CVE-2025-68874Visitor Stats Widget (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-01-08CVE Database V5CVE-2025-68874 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through <= 1.5.0. EPSS 0.2%Vulnerability Shahjada	CVE Database V5	2026-01-08
Medium	4.3	EPSS 0.3%	CVE-2025-63070Download Manager (WordPress plugin) · Exposure of Sensitive System Information to an Unauthorized Control Sphere Medium4.3EPSS 0.3%2025-12-09CVE Database V5CVE-2025-63070 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32. EPSS 0.3%Vulnerability Shahjada CWE-497	CVE Database V5	2025-12-09
Medium	4.3	EPSS 0.1%	CVE-2025-60093Download Manager (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.1%2025-09-26CVE Database V5CVE-2025-60093 Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24. EPSS 0.1%Vulnerability Shahjada CWE-352	CVE Database V5	2025-09-26
Medium	5.3	EPSS 0.3%	CVE-2025-60092Download Manager (WordPress plugin) · Exposure of Sensitive System Information to an Unauthorized Control Sphere Medium5.3EPSS 0.3%2025-09-26CVE Database V5CVE-2025-60092 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25. EPSS 0.3%Vulnerability Shahjada CWE-497	CVE Database V5	2025-09-26
Medium	4.3	EPSS 0.1%	CVE-2025-54732WPDM (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.1%2025-08-14CVE Database V5CVE-2025-54732 Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Cross Site Request Forgery.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.2. EPSS 0.1%Vulnerability Shahjada	CVE Database V5	2025-08-14
Medium	6.5	EPSS 0.3%	CVE-2025-30991WPDM (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.3%2025-06-06CVE Database V5CVE-2025-30991 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6. EPSS 0.3%Vulnerability Shahjada	CVE Database V5	2025-06-06
Medium	5.4	EPSS 0.4%	CVE-2025-39560Live Forms (WordPress plugin) · Missing Authorization Medium5.4EPSS 0.4%2025-04-16CVE Database V5CVE-2025-39560 Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4. EPSS 0.4%Vulnerability Shahjada	CVE Database V5	2025-04-16
Medium	4.3	EPSS 0.3%	CVE-2025-32279Live Forms (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2025-04-08CVE Database V5CVE-2025-32279 Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5. EPSS 0.3%Vulnerability Shahjada	CVE Database V5	2025-04-08
Medium	5.4	EPSS 0.5%	CVE-2025-30809Live Forms (WordPress plugin) · Missing Authorization Medium5.4EPSS 0.5%2025-03-27CVE Database V5CVE-2025-30809 Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4. EPSS 0.5%Vulnerability Shahjada	CVE Database V5	2025-03-27
High	7.6	EPSS 1.0%	CVE-2025-24659WPDM (WordPress plugin) · SQL Injection High7.6EPSS 1.0%2025-01-24CVE Database V5CVE-2025-24659 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6. EPSS 1.0%Vulnerability Shahjada	CVE Database V5	2025-01-24
Medium	4.3	EPSS 0.3%	CVE-2024-56217Download Manager (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2024-12-31CVE Database V5CVE-2024-56217 Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03. EPSS 0.3%Vulnerability Shahjada	CVE Database V5	2024-12-31
High	7.6	EPSS 0.5%	CVE-2024-52435WPDM (WordPress plugin) · SQL Injection High7.6EPSS 0.5%2024-11-18CVE Database V5CVE-2024-52435 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.5. EPSS 0.5%Vulnerability Shahjada	CVE Database V5	2024-11-18

Page 1 of 1