Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Download Manager · Version history

Download Manager changelog and version history

Latest version
3.3.76
Nov 7, 2026 (2 days ago)
Releases
183
since 2012
In the last year
44
about one every 8 days
Tested up to
WordPress 7.1.4

Releases each year

  • 20122 releases
  • 20144 releases
  • 20161 release
  • 20192 releases
  • 20204 releases
  • 202128 releases
  • 202230 releases
  • 202319 releases
  • 202421 releases
  • 202536 releases
  • 202636 releases

202636 releases

  1. Download Manager 3.3.76Latest

    • Fixed: [wpdm_all_packages] raised a notice for packages without a stored size
    • Security: An Author could replace or hijack another user’s chunked package upload by sending the same file name; chunks are now assembled per user and a taken name gets a prefix, as with plain uploads ( Reported by Respect )
    • Security: The [wpdm_all_packages] cols attribute could print other users’ package passwords; the post password is no longer available as a column ( Reported by Karthik Ramakrishnan via WPScan )
    • Security: An Author could store a quote in an additional preview image or video link and run script on the package page; previews are now limited to attachment IDs and URLs, and the links are escaped ( Reported by Wordfence )

  2. Download Manager 3.3.75

    • Security: A refused registration could rewrite the first administrator’s name; author names are now escaped in the Spotlight template ( Reported via Wordfence )
    • Security: REST package search returned packages the visitor can’t access; the /wp/v2/wpdmpro route now follows “Hide all package info” ( Reported by Venkateswara Reddy )
    • Security: A Contributor could embed and download any Asset Manager file with [wpdm_asset]; links now need the post’s author or the viewer to have access ( Reported by 0xRrudy )
    • Fixed: Pages listing many packages were slow on large sites; per-user download counts are now indexed and duplicate asset link indexes removed
    • Fixed: The cache cleanup cron URL stopped working; one cron URL in Cron Jobs settings now runs every scheduled task
    • Improved: Recent Jobs list with icon actions, job names, last errors and site-timezone times

  3. Download Manager 3.3.74

    • Security: Private packages were downloadable by any logged-in user; unpublished packages now require permission to read the package ( Reported by wellknown.info )
    • Security: The showLockOptions AJAX action no longer returns download links for packages the user can’t access
    • New: Dedicated MCP server at /wp-json/wpdm/mcp lists enabled AI abilities as first-class tools ( needs the MCP Adapter plugin )
    • New: MCP resources for the category tree and site download settings, and prompts for publishing a release and writing an activity report
    • New: AI abilities to restore trashed packages, edit and delete categories, list tags, edit attached file details, read download history and regenerate master keys
    • Fixed: Package stock limit was never enforced on downloads
    • Improved: AI abilities – atomic rate limits, downloads sort keeps new packages, DST-safe daily stats, audit log paging and user filter, application password warning

  4. Download Manager 3.3.73

    • New: AI Abilities let Claude, Cursor and other MCP clients manage packages, files, download links, categories and stats (WordPress 6.9+, off until enabled in Settings → AI Abilities)
    • Security: Fixed unauthenticated download of protected files via audio and video preview links ( Reported by Ananda Dhakal via Patchstack )
    • Security: Password lock no longer issues a download link for packages the user’s role can’t access
    • Fixed: Duplicating a package with no category or tag caused a fatal error on PHP 8

  5. Download Manager 3.3.72

    • Improved: Refreshed the Asset Manager rename dialog and Share tab
    • Security: Fixed Contributor+ Stored XSS via the regurl attribute of the [wpdm_login_form] shortcode ( Reported by Wordfence )
    • Security: Fixed Subscriber+ sensitive information exposure via email template tokens in profile fields ( Reported by Wordfence )

  6. Download Manager 3.3.71

    • Security: Fixed Subscriber+ Stored XSS via display name in the Download History user filter ( Reported by Wordfence )
    • Security: Fixed CSRF on the settings screen that could overwrite Privacy options, including the cron key ( Reported by Kartik Sharma via WPScan )
    • Security: Fixed unauthenticated download of protected files via cross-package CAPTCHA validation ( Reported by Raj Ukani via WPScan )
    • Security: Fixed Author+ Stored XSS via the package icon URL ( Reported by Mark Moore via WPScan )
    • Fixed: Display names are escaped in the public profile card and account status view

  7. Download Manager 3.3.70

    • Fixed: Previewing a large link or page template failed because the whole template was passed in the preview URL and exceeded the server’s URI length limit; the template is now held server-side for the preview session and the URL carries only a short-lived token
    • Fixed: The related downloads section rendered an empty wrapper when a package had no related downloads; nothing is output now when there is nothing to show
    • Fixed: A PHP warning – “file_exists(): File name is longer than the maximum allowed path length” – while rendering a package whose link or page template is given as inline markup rather than the name of a saved template; the lookup now recognises that such a value cannot be a template id instead of…

  8. Download Manager 3.3.69

    • Improved: The Asset Manager’s New Folder and New File dialogs are now a single panel that anchors under the button that opened it, with inline validation for empty names and names containing slashes, a busy state while the folder or file is created, and any error returned by the server shown in pla…
    • Improved: Rebuilt the Asset Manager upload tray with a dedicated drop zone, a running “x of y uploaded” summary, a “Clear finished” action, and per-file rows carrying a progress bar, transferred size and final status
    • Fixed: A failed upload in the Asset Manager gave no indication of what had gone wrong – oversized files, disallowed file types and expired sessions now report the reason on the file’s own row
    • Fixed: A malformed HTTP Range header could raise a PHP warning, or a fatal “Unsupported operand types” error on PHP 8, while serving a download; range requests are now validated and answered with a 416 Requested Range Not Satisfiable response when the range cannot be served
    • Fixed: A ranged download streamed the remainder of the file past the requested end byte, and a suffix range ( e.g. “bytes=-500”, meaning the last 500 bytes ) was miscalculated
    • Security: Contributor+ Insecure Direct Object Reference in the package duplicate handler – the handler hooked on admin_init checked only the generic edit_posts capability, which every contributor holds, and a plugin-wide static nonce action that any logged-in user could obtain from an unrelated fro…

  9. Download Manager 3.3.68

    • Improved: Redesigned the activity report email with a clearer hierarchy – the headline figure now leads each section, metric cards share a common baseline, and every section carries a designed empty state so a quiet period still reads as intentional
    • Improved: Activity report tables now expose proper column headers to screen readers, and layout tables are marked as presentational
    • Security: Unauthenticated password-protection bypass via PHP type juggling – the package password check ( validate-password REST endpoint ) used a loose comparison, so a download protected with an all-numeric password could be unlocked by submitting an equivalent numeric string ( e.g. “1.23e2” in p…
    • Security: Missing Authorization on the public profile menu endpoint ( wpdm_get_profile_menu_content ) let unauthenticated visitors read any registered user’s favourites list by passing an arbitrary user id; the profile owner id is now bound into the signed request token and the handler validates th…

  10. Download Manager 3.3.67

    • Security: Contributor+ Stored Cross-Site Scripting via the icon and icon_width attributes of the [wpdm_category] shortcode – the attribute values were interpolated into the image tag unescaped and could break out of the src / style attribute to inject an onerror/onload handler; UI::img() now escape…

  11. Download Manager 3.3.66

    • Security: Author+ Stored Cross-Site Scripting via Package Title – the title was run through stripcslashes() when rendered, which decoded C-style escape sequences back into active markup after save-time sanitization had already accepted them; the title is no longer decoded and is now escaped on outp…
    • Security: Removed the same escape-sequence decoding from the package description and excerpt, which were open to the identical Author+ Stored XSS vector; the excerpt is now sanitized with wp_kses_post() instead of a filter that only stripped script tags
    • Security: The package title and page URL are now escaped where they are substituted into the QR code image attributes
    • Security: Removed the unauthenticated POST /wpdm/view-count REST route, which let anyone increment the view counter meta on any post ID; the route was unused, as view counts are recorded through the wpdm_view_count ajax action
    • Security: The view count handler now verifies its nonce, which had been left commented out, and only accepts wpdmpro packages, so the counter meta can no longer be created on unrelated posts and pages

  12. Download Manager 3.3.65

    • Fixed: The [wpdm_changelog] shortcode rendered unstyled, because its markup was emitted without the wrapper element that the front-end stylesheet scopes every changelog rule to

  13. Download Manager 3.3.64

    • Fixed: The [changelog] template tag rendered unstyled, because the front-end stylesheet still targeted an older markup structure – entry content was hidden outright, the timeline had no layout and the icons rendered at their oversized default dimensions
    • Fixed: Changelog toggling stopped working entirely on pages holding more than one changelog, where every entry picked up a duplicate click handler that cancelled itself out
    • Improved: Changelog toggle buttons now expose their expanded state to assistive technology, and the newest release is highlighted in both light and dark mode

  14. Download Manager 3.3.63

    • New: Activity Reports – scheduled weekly or monthly summary emails covering downloads, top packages, trending items, user activity, category breakdown and storage usage, with configurable sections, recipients, schedule and a test-report option
    • New: Cron Jobs settings tab showing background job stats, job history and scheduled events
    • Improved: Rebuilt the background job system with job queues, priorities, automatic retries and job locking; job handlers are now whitelisted for security
    • Improved: Legacy confirmation dialogs now route through the WPDM dialog system with proper button styling and a graceful fallback when the dialog script is unavailable
    • Fixed: The “require admin approval” check now applies to every authentication flow, so unapproved accounts can no longer sign in through flows that skip the username parameter
    • Fixed: PHP warning for an undefined variable during authentication
    • Fixed: The [changelog] template tag is now parsed in package page templates, so the changelog timeline renders instead of printing the raw tag
    • Fixed: The [hide_empty:tag] template tag no longer leaks into the markup when the target tag has a value

  15. Download Manager 3.3.62

    • Improved: Expirable download link handling
    • Improved: Emailed and shareable download links are now kept in a durable, indexed store instead of post meta, so they survive cache clears and no longer bloat package meta
    • Improved: Indexed the sessions table and stopped duplicate-row accumulation for faster temporary-token lookups and cleanup
    • Security: Added directory-traversal containment to the protected media file handler so the wpdmmedia parameter cannot resolve to files outside the uploads directory
    • Security: Media password verification now requires the item to be private with a non-empty password and uses a strict comparison
    • Security: Hardened the modal login form redirect field ( REQUEST_URI ) with esc_url() output escaping
    • Security: Authenticated (Contributor+) Stored Cross-Site Scripting via the note_before and note_after attributes of the wpdm_reg_form shortcode ( Reported by Wordfence )
    • Security: Temporary download link tokens ( _wpdmkey ) are now generated with a cryptographically secure generator instead of uniqid() ( Reported by Pedro Pinho )
    • Security: Download links issued after a password, captcha or role lock are now bound to the originating session and can no longer be reused from a different device or session if the link is leaked ( Reported by Pedro Pinho )

  16. Download Manager 3.3.61

    • Fixed: Authenticated (Contributor+) Stored Cross-Site Scripting via the no_data_msg attribute of the wpdm_all_packages shortcode ( Reported by Wordfence )

  17. Download Manager 3.3.60

    • Fixed: Stats history page no longer sends stored visitor IP addresses to the external geolocation API when IP handling is disabled ( __wpdm_noip )
    • Fixed: Stats history page now loads the bundled local Select2 assets instead of an external CDN ( supply-chain hardening )
    • Fixed: Escaped the visitor IP in the ip-api.com lookup links on the stats history page

  18. Download Manager 3.3.59

    • Fixed: Authenticated (Contributor+) Stored Cross-Site Scripting via the not_found attribute of the wpdm_packages shortcode ( Reported by Wordfence )
    • Improved: Modernized admin dialogs by routing alert/confirm/popup modals and the password generator through the WPDM dialog system
    • Improved: Redesigned the Add-Ons page with a modern, card-based UI
    • Improved: Category filter on the Add-Ons page now shows the add-on count for each category
    • Fixed: Social media icons in email templates no longer render with an empty link when the profile URL is left blank

  19. Download Manager 3.3.58

    • New: Category filter dropdown on the package list table
    • New: Sortable “Views” column on the package list table
    • New: Inline status badges ( No file attached / Locked / Password ) on the package list
    • New: Bulk actions to duplicate packages and reset download count
    • Fixed: Reflected XSS via the REFERRER parameter on the download lock iframe ( Reported by Wordfence )

  20. Download Manager 3.3.57

    • Hardened: Use prepared statement in TempStorage::get() as a defense-in-depth measure against SQL injection

  21. Download Manager 3.3.56

    • Compatibility update for WorPress 7.0
    • Fixed: XSS issue in download history page ( Reported by Jungnickel, Luca Moritz )

  22. Download Manager 3.3.55

    • Improved: Crypt class
    • Improved: Sanitization function

  23. Download Manager 3.3.54

    • Fixed: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ( Reported by Patchstack )
    • Fixed: An UI issue with the asset manager file settings

  24. Download Manager 3.3.53

    • Fixed: Authenticated (Contributor+) Stored Cross-Site Scripting via icon input ( Reported by Wordfence )

  25. Download Manager 3.3.52

    • Fixed: Missing Authorization to Authenticated (Contributor+) Media File Protection Removal ( Reported by Wordfence )

  26. Download Manager 3.3.51

  27. Download Manager 3.3.50

  28. Download Manager 3.3.49

  29. Download Manager 3.3.48

  30. Download Manager 3.3.47

  31. Download Manager 3.3.46

  32. Download Manager 3.3.45

  33. Download Manager 3.3.44

  34. Download Manager 3.3.43

  35. Download Manager 3.3.42

  36. Download Manager 3.3.41

202536 releases

  1. Download Manager 3.3.40

  2. Download Manager 3.3.39

  3. Download Manager 3.3.38

  4. Download Manager 3.3.37

  5. Download Manager 3.3.36

  6. Download Manager 3.3.35

  7. Download Manager 3.3.34

  8. Download Manager 3.3.33

  9. Download Manager 3.3.32

  10. Download Manager 3.3.31

  11. Download Manager 3.3.30

  12. Download Manager 3.3.29

  13. Download Manager 3.3.28

  14. Download Manager 3.3.27

  15. Download Manager 3.3.26

  16. Download Manager 3.3.25

  17. Download Manager 3.3.24

  18. Download Manager 3.3.23

  19. Download Manager 3.3.22

  20. Download Manager 3.3.21

  21. Download Manager 3.3.20

  22. Download Manager 3.3.19

  23. Download Manager 3.3.18

  24. Download Manager 3.3.17

  25. Download Manager 3.3.16

  26. Download Manager 3.3.15

  27. Download Manager 3.3.14

  28. Download Manager 3.3.13

  29. Download Manager 3.3.12

  30. Download Manager 3.3.11

  31. Download Manager 3.3.10

  32. Download Manager 3.3.09

  33. Download Manager 3.3.08

  34. Download Manager 3.3.07

  35. Download Manager 3.3.06

  36. Download Manager 3.3.05

202421 releases

  1. Download Manager 3.3.04

  2. Download Manager 3.3.03

  3. Download Manager 3.3.02

  4. Download Manager 3.3.01

  5. Download Manager 3.3.00

  6. Download Manager 3.2.99

  7. Download Manager 3.2.98

  8. Download Manager 3.2.97

  9. Download Manager 3.2.96

  10. Download Manager 3.2.95

  11. Download Manager 3.2.94

  12. Download Manager 3.2.93

  13. Download Manager 3.2.92

  14. Download Manager 3.2.91

  15. Download Manager 3.2.90

  16. Download Manager 3.2.89

  17. Download Manager 3.2.88

  18. Download Manager 3.2.87

  19. Download Manager 3.2.86

  20. Download Manager 3.2.85

  21. Download Manager 3.2.84

202319 releases

  1. Download Manager 3.2.83

  2. Download Manager 3.2.82

  3. Download Manager 3.2.81

  4. Download Manager 3.2.80

  5. Download Manager 3.2.79

  6. Download Manager 3.2.78

  7. Download Manager 3.2.77

  8. Download Manager 3.2.76

  9. Download Manager 3.2.75

  10. Download Manager 3.2.74

  11. Download Manager 3.2.73

  12. Download Manager 3.2.72

  13. Download Manager 3.2.71

  14. Download Manager 3.2.70

  15. Download Manager 3.2.69

  16. Download Manager 3.2.68

  17. Download Manager 3.2.67

  18. Download Manager 3.2.66

  19. Download Manager 3.2.65

202230 releases

  1. Download Manager 3.2.64

  2. Download Manager 3.2.63

  3. Download Manager 3.2.61

  4. Download Manager 3.2.60

  5. Download Manager 3.2.59

  6. Download Manager 3.2.58

  7. Download Manager 3.2.57

  8. Download Manager 3.2.56

  9. Download Manager 3.2.55

  10. Download Manager 3.2.54

  11. Download Manager 3.2.53

  12. Download Manager 3.2.52

  13. Download Manager 3.2.51

  14. Download Manager 3.2.50

  15. Download Manager 3.2.49

  16. Download Manager 3.2.48

  17. Download Manager 3.2.47

  18. Download Manager 3.2.46

  19. Download Manager 3.2.45

  20. Download Manager 3.2.44

  21. Download Manager 3.2.43

  22. Download Manager 3.2.42

  23. Download Manager 3.2.41

  24. Download Manager 3.2.40

  25. Download Manager 3.2.39

  26. Download Manager 3.2.38

  27. Download Manager 3.2.37

  28. Download Manager 3.2.35

  29. Download Manager 3.2.34

  30. Download Manager 3.2.33

202128 releases

  1. Download Manager 3.2.32

  2. Download Manager 3.2.31

  3. Download Manager 3.2.30

  4. Download Manager 3.2.29

  5. Download Manager 3.2.28

  6. Download Manager 3.2.27

  7. Download Manager 3.2.25

  8. Download Manager 3.2.24

  9. Download Manager 3.2.23

  10. Download Manager 3.2.22

  11. Download Manager 3.2.21

  12. Download Manager 3.2.19

  13. Download Manager 3.2.18

  14. Download Manager 3.2.16

  15. Download Manager 3.2.14

  16. Download Manager 3.2.13

  17. Download Manager 3.2.04

  18. Download Manager 3.1.28

  19. Download Manager 3.1.27

  20. Download Manager 3.1.26

  21. Download Manager 3.1.25

  22. Download Manager 3.1.24

  23. Download Manager 3.1.23

  24. Download Manager 3.1.22

  25. Download Manager 3.1.18

  26. Download Manager 3.1.17

  27. Download Manager 3.1.14

  28. Download Manager 3.1.12

20204 releases

  1. Download Manager 3.1.11

  2. Download Manager 3.1.08

  3. Download Manager 3.1.07

  4. Download Manager 3.1.05

20192 releases

  1. Download Manager 3.0.4

  2. Download Manager 2.9.99

20161 release

  1. Download Manager 2.8.3

20144 releases

  1. Download Manager 2.6.96

  2. Download Manager 2.6.2

  3. Download Manager 2.5.97

  4. Download Manager 2.5.96

20122 releases

  1. Download Manager 2.3.0

  2. Download Manager 2.1.3

Questions about Download Manager’s releases

What is the latest version of Download Manager?

3.3.76, released on Nov 7, 2026 (2 days ago). It’s tested up to WordPress 7.1.4.

How often is Download Manager updated?

44 releases in the last year, about one every 8 days. Its first release on WordPress.org dates from February 2012.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Download Manager’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.