Read the docs

Lana

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Lana records in CISA KEV

No Lana vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Lana Downloads Manager 2 records MEDIUM Lana Shortcodes 1 record MEDIUM

Records

3 records

TI-2023-03153 CVE-2023-3372 · GHSA-497h-jp43-7hhx

Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS

Priority MEDIUM 58

The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contrib…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00485 Published 2024-01-16 Fixed in 1.2.0 CWE-79
TI-2025-01786 CVE-2025-2048 · GHSA-jw49-5g4r-c94w

Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal

Priority MEDIUM 52

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the serv…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00527 Published 2025-04-01 Fixed in 1.10.0 CWE-22
TI-2022-02208 CVE-2022-2392 · GHSA-789c-4pgv-92rh

Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download

Priority LOW 31

The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01127 Published 2022-08-22 Fixed in 1.8.0 CWE-552
Open these records in search →