Skip to content
PluginCanary

Download Manager

by Shahjada · 100,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (38 of 100).

78/ 100 Canary Score
Sub-scores for Download Manager
Ownership100
Maintenance100
Security60
Support38
Reputation85

How the score works

Quick answers

Is Download Manager still maintained?
Yes. Last release 1 Nov 2026, 73 releases in the last 24 months. 1 Nov 2026 · wordpress.org
Who owns Download Manager, and has it changed hands?
No change recorded. Main committer codename065 since Feb 2010. 4 Nov 2026 · SVN log
Was Download Manager removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Download Manager safe?
91 known vulnerabilities, all fixed (latest in 3.3.71). Not on the exploited list. 19 Oct 2026 · Wordfence Intelligence
Is the latest Download Manager update safe to install?
No ownership change before 3.3.75. No one-star spike after it. 1 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
codename06510 Feb 2010 to 1 Nov 2026, 781 commits

1 committer recorded. No ownership change since 2010.

Maintenance

Last release
3 days ago
Releases, 24 months
73
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Download Manager
Q1 20246
Q2 20247
Q3 20243
Q4 20245
Q1 20257
Q2 20258
Q3 20256
Q4 202515
Q1 202612
Q2 20269
Q3 202610
Q4 20264

Last release 1 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (4 reviews). Lifetime: 4.1.

Average rating per quarter for Download Manager
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20264.9
Q2 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q2 2025 and Q3 2026.

Rating distribution
5 star736
4 star44
3 star24
2 star33
1 star169

Security record

34 vulnerabilities in 24 months (91 on record), all patched (latest fixed in 3.3.71).

Show 91 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
19 Oct 2026Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery4.3<= 3.3.70, 4.0.0 to 7.5.83.3.71Patched before disclosure
9 Oct 2026Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter6.1<= 3.3.573.3.58Patched before disclosure
9 Oct 2026Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode6.4<= 3.3.583.3.59Patched before disclosure
9 Oct 2026Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email4.3<= 3.3.713.3.72Patched before disclosure
9 Oct 2026Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute6.4<= 3.3.713.3.72Patched before disclosure
2 Oct 2026Download Manager <= 3.3.70 - Unauthenticated Information Exposure5.3<= 3.3.703.3.71Patched before disclosure
1 Oct 2026Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name6.4<= 3.3.703.3.71Patched before disclosure
17 Sep 2026Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter6.5<= 3.3.683.3.69Patched before disclosure
5 Aug 2026Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting7.2< 3.3.663.3.66Patched before disclosure
31 Jul 2026Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute6.4<= 3.3.663.3.67Patched before disclosure
8 Jul 2026Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes6.4<= 3.3.613.3.62Patched before disclosure
30 Jun 2026Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute6.4<= 3.3.603.3.61Patched before disclosure
9 Apr 2026Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal4.3<= 3.3.513.3.52Patched before disclosure
8 Apr 2026Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4<= 3.3.523.3.53Patched before disclosure
18 Mar 2026Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter4.3<= 3.3.493.3.50Patched before disclosure
19 Feb 2026Download Manager <= 3.3.52 - Missing Authorization5.3<= 3.3.523.3.5348
17 Feb 2026Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter6.1<= 3.3.463.3.47Patched before disclosure
10 Feb 2026Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.3.533.3.5464
5 Jan 2026Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword7.3<= 3.3.403.3.41Patched before disclosure
17 Dec 2025Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure4.3<= 3.3.323.3.33Patched before disclosure
7 Nov 2025Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key5.3<= 3.3.303.3.31Patched before disclosure
30 Sep 2025Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure4.3<= 3.3.323.3.3369
26 Sep 2025Download Manager <= 3.3.24 - Cross-Site Request Forgery4.3<= 3.3.243.3.255
26 Sep 2025Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure5.3<= 3.3.253.3.2611
18 Sep 2025Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter6.1<= 3.3.233.3.24Patched before disclosure

Changelog mentions of security fixes: 3.3.56 (XSS); 3.3.57 (SQL injection); 3.3.58 (XSS); 3.3.60 (escaping); 3.3.62 (security, escaping).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

38% of 8 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Download Manager
4 May 20264,545
11 May 20266,884
18 May 20267,626
25 May 202662,229
1 Jun 20269,225
8 Jun 20265,781
15 Jun 202634,339
22 Jun 20267,361
29 Jun 202687,822
6 Jul 202638,904
13 Jul 202665,246
20 Jul 20269,435
27 Jul 202635,275
3 Aug 202611,685
10 Aug 20265,964
17 Aug 202632,213
24 Aug 202610,421
31 Aug 20266,677
7 Sep 20265,159
14 Sep 202637,024
21 Sep 202658,450
28 Sep 202647,060
5 Oct 202614,445
12 Oct 202634,413
19 Oct 202613,783
26 Oct 202641,843
2 Nov 202627,584

Weekly downloads over the last 4 weeks are 10% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Embed PDF ViewerScore 96 · 20,000+flowpaperScore 93 · 10,000+PDF EmbedderScore 91 · 300,000+PDF Viewer Block for GutenbergScore 91 · 10,000+Pdf EmbedScore 91 · 10,000+

Facts

Version3.3.75
AuthorShahjada
Added10 Feb 2010
Last updated1 Nov 2026
Active installs100,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHPnot stated
CategoryE-commerce & Shopping > Digital Products & Downloads
Tagsecommerce, file manager, digital store, download manager, document management

Other plugins by this author: Download Manager Addons for Elementor, Editor Blocks by Download Manager, Premium Packages - Sell Digital Products Securely, WP Tabular - HTML Table Generator for WordPress, Visitor Stats Widget

Questions

Is Download Manager still maintained?

Yes. Last release 1 Nov 2026, 73 releases in the last 24 months.

Who owns Download Manager, and has it changed hands?

No change recorded. Main committer codename065 since Feb 2010.

Was Download Manager removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Download Manager safe?

91 known vulnerabilities, all fixed (latest in 3.3.71). Not on the exploited list.

Is the latest Download Manager update safe to install?

No ownership change before 3.3.75. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue