Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Lana Clear all filters
TI-2025-01786 CVE-2025-2048 · GHSA-jw49-5g4r-c94w

Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal

Priority MEDIUM 52

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the serv…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00527 Published 2025-04-01 Fixed in 1.10.0 CWE-22
TI-2023-03153 CVE-2023-3372 · GHSA-497h-jp43-7hhx

Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS

Priority MEDIUM 58

The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contrib…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00485 Published 2024-01-16 Fixed in 1.2.0 CWE-79
TI-2022-02208 CVE-2022-2392 · GHSA-789c-4pgv-92rh

Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download

Priority LOW 31

The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01148 Published 2022-08-22 Fixed in 1.8.0 CWE-552