WordPress CM Download Manager plugin versions 2.0.6 and below suffer from cross site request forgery and cross site scripting vulnerabilities.