Vulnerabilities and security researches fordownload-monitor download-monitor

Direction: ascending

Jun 06, 2024

Download Monitor # CVE-2021-24786

CVE, Research URL: CVE-2021-24786
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 03, 2022
Research Description: The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Affected versions: max 4.4.5.
Status: vulnerable

Download Monitor # CVE-2015-9296

CVE, Research URL: CVE-2015-9296
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Aug 13, 2019
Research Description: The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Affected versions: max 1.7.1.
Status: vulnerable

Download Monitor # CVE-2021-36920

CVE, Research URL: CVE-2021-36920
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 15, 2022
Research Description: Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
Affected versions: max 4.4.7.
Status: vulnerable

Download Monitor # CVE-2008-1646

CVE, Research URL: CVE-2008-1646
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Apr 02, 2008
Research Description: SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.
Affected versions: max 1.2.1.
Status: vulnerable

Download Monitor # CVE-2021-23174

CVE, Research URL: CVE-2021-23174
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 29, 2022
Research Description: Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
Affected versions: max 4.4.7.
Status: vulnerable

Download Monitor # CVE-2021-31567

CVE, Research URL: CVE-2021-31567
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 29, 2022
Research Description: Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
Affected versions: max 4.4.7.
Status: vulnerable

Download Monitor # CVE-2012-4768

CVE, Research URL: CVE-2012-4768
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Sep 04, 2014
Research Description: Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
Affected versions: max 3.3.5.9.
Status: vulnerable

Download Monitor # CVE-2008-2034

CVE, Research URL: CVE-2008-2034
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Apr 30, 2008
Research Description: SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected versions: max 2.0.9.
Status: vulnerable

Download Monitor # CVE-2022-2222

CVE, Research URL: CVE-2022-2222
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jul 17, 2022
Research Description: The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Affected versions: max 4.5.91.
Status: vulnerable

Download Monitor # CVE-2022-2981

CVE, Research URL: CVE-2022-2981
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 11, 2022
Research Description: The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Affected versions: max 4.5.98.
Status: vulnerable

Download Monitor # CVE-2022-45354

CVE, Research URL: CVE-2022-45354
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 09, 2024
Research Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
Affected versions: max 4.7.70.
Status: vulnerable

Download Monitor # CVE-2023-31219

CVE, Research URL: CVE-2023-31219
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Nov 13, 2023
Research Description: Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.
Affected versions: max 4.8.2.
Status: vulnerable

Download Monitor # CVE-2013-3262

CVE, Research URL: CVE-2013-3262
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Aug 10, 2013
Research Description: Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Affected versions: max 3.3.6.2.
Status: vulnerable

Download Monitor # CVE-2013-5098

CVE, Research URL: CVE-2013-5098
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Aug 10, 2013
Research Description: Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
Affected versions: max 3.3.6.2.
Status: vulnerable

Download Monitor # CVE-2023-34007

CVE, Research URL: CVE-2023-34007
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Dec 21, 2023
Research Description: Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
Affected versions: max 4.8.4.
Status: vulnerable

Download Monitor # CVE-2024-30501

CVE, Research URL: CVE-2024-30501
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Mar 29, 2024
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
Affected versions: max 4.9.5.
Status: vulnerable

Download Monitor # CVE-2024-3269

CVE, Research URL: CVE-2024-3269
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: May 30, 2024
Research Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.
Affected versions: max 4.9.14.
Status: vulnerable

Sep 26, 2024

Download Monitor # CVE-2024-8552

CVE, Research URL: CVE-2024-8552
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Sep 26, 2024
Research Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.
Affected versions: max 5.0.10.
Status: vulnerable

Oct 18, 2024

Download Monitor # CVE-2022-4972

CVE, Research URL: CVE-2022-4972
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 16, 2024
Research Description: The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Affected versions: max 4.7.52.
Status: vulnerable

Oct 27, 2024

Download Monitor # CVE-2024-10092

CVE, Research URL: CVE-2024-10092
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 26, 2024
Research Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.
Affected versions: max 5.0.13.
Status: vulnerable

Oct 31, 2024

Download Monitor # CVE-2024-10399

CVE, Research URL: CVE-2024-10399
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 30, 2024
Research Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
Affected versions: max 5.0.14.
Status: vulnerable

May 09, 2025

Download Monitor # CVE-2025-47439

CVE, Research URL: CVE-2025-47439
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: May 07, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through <= 5.0.22.
Affected versions: max 5.0.23.
Status: vulnerable

Apr 14, 2026

Download Monitor # CVE-2026-3124

CVE, Research URL: CVE-2026-3124
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Mar 30, 2026
Research Description: The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.
Affected versions: max 5.1.8.
Status: vulnerable

Download Monitor # CVE-2026-4401

CVE, Research URL: CVE-2026-4401
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Apr 08, 2026
Research Description: The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 5.1.11.
Status: vulnerable

Download Monitor # CVE-2026-39486

CVE, Research URL: CVE-2026-39486
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Apr 08, 2026
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.
Affected versions: max 5.1.9.
Status: vulnerable

May 02, 2026

Download Monitor # CVE-2026-39489

CVE, Research URL: CVE-2026-39489
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: -
Research Description: Download Monitor [download-monitor] < 5.1.10 CVE-2026-39489
Affected versions: max 5.1.10.
Status: vulnerable

Jun 15, 2026

Download Monitor # 98f6fe3c1e368e45554e8dd81d73b2ced1540fae

CVE, Research URL: 98f6fe3c1e368e45554e8dd81d73b2ced1540fae
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Aug 11, 2016
Research Description: Download Monitor [download-monitor] < 1.6.4 WordPress Download Monitor Plugin <= 1.6.3 - Authenticated Directory Listing This plugin is prone to an authenticated directory listing vulnerability. It allows attackers list sever side files and directories. Update the plugin.
Affected versions: max 1.6.4.
Status: vulnerable

Download Monitor # 7a142941e5d14e8bc2a1b469281c9ada144d4cc9

CVE, Research URL: 7a142941e5d14e8bc2a1b469281c9ada144d4cc9
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jun 07, 2023
Research Description: Download Monitor [download-monitor] < 4.8.4 Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file The Download Monitor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and access controls on the 'upload_file' function in versions up to, and including, 4.8.3. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected versions: max 4.8.4.
Status: vulnerable

Download Monitor # 46ca7cde9bef3abc841ab15d24d25f29bc88cd2b

CVE, Research URL: 46ca7cde9bef3abc841ab15d24d25f29bc88cd2b
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: May 05, 2017
Research Description: Download Monitor [download-monitor] < 1.9.7 Download Monitor <= 1.9.6 - Missing Authorization The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the delete_logs() and export_logs() functions in versions up to, and including, 1.9.6. This makes it possible for unauthenticated attackers to delete and export several log types.
Affected versions: max 1.9.7.
Status: vulnerable

Download Monitor # f5860b327086138ba7c86b4d57c3f4d6b08a8b4e

CVE, Research URL: f5860b327086138ba7c86b4d57c3f4d6b08a8b4e
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Apr 20, 2015
Research Description: Download Monitor [download-monitor] <= 1.6.4 Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting The Download Monitor plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on remove_query_arg and add_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Affected versions: max 1.6.4.
Status: vulnerable

Download Monitor # fbe2588da943f9426ce5fe110b52bfe2fe5d4913

CVE, Research URL: fbe2588da943f9426ce5fe110b52bfe2fe5d4913
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Nov 26, 2022
Research Description: Download Monitor [download-monitor] < 4.7.52 Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Affected versions: max 4.7.52.
Status: vulnerable

Download Monitor # 2ff027fefc6d9b0e352553c7601d08f067184608

CVE, Research URL: 2ff027fefc6d9b0e352553c7601d08f067184608
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Nov 01, 2022
Research Description: Download Monitor [download-monitor] < 4.7.3 Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure The Download Monitor plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.7.2 via the list_files function. This allows users with manage_downloads permissions to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected versions: max 4.7.3.
Status: vulnerable

Download Monitor # 938246df9c6e64214f96199eb617b2dfc97b1cae

CVE, Research URL: 938246df9c6e64214f96199eb617b2dfc97b1cae
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jun 09, 2023
Research Description: Download Monitor [download-monitor] < 4.7.70 Download Monitor <= 4.7.60 - Missing Authorization to Authenticated Data Export The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to an insufficient capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.60. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to view user data and other sensitive information intended for administrators.
Affected versions: max 4.7.70.
Status: vulnerable

Download Monitor # 42d98bd63f604359ece14631c2b162a4de1526a1

CVE, Research URL: 42d98bd63f604359ece14631c2b162a4de1526a1
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: May 15, 2015
Research Description: Download Monitor [download-monitor] < 1.7.1 WordPress Download Monitor Plugin <= 1.7.0 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.
Affected versions: max 1.7.1.
Status: vulnerable

Download Monitor # a84882a0-5b18-49dd-9be3-a1d92045d5a9

CVE, Research URL: a84882a0-5b18-49dd-9be3-a1d92045d5a9
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: -
Research Description: Download Monitor [download-monitor] < 1.6.4 Download Monitor < 1.6.4 - Authenticated Directory Listing Directory listing vulnerability that can lead to information disclosure. Authenticated users can list sever side files and directories.
Affected versions: max 1.6.4.
Status: vulnerable

Download Monitor # c996842b5799f2226e6f8eaefa8141467ad4bf5c

CVE, Research URL: c996842b5799f2226e6f8eaefa8141467ad4bf5c
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Mar 08, 2015
Research Description: Download Monitor [download-monitor] < 1.6.4 Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure The Download Monitor plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.6.3 via the 'dir' parameter. This can allow authenticated attackers to extract sensitive data including directories and otherwise restricted server-side filenames.
Affected versions: max 1.6.4.
Status: vulnerable

Download Monitor # a9d39906-1704-43c9-a503-759c72ab465e

CVE, Research URL: a9d39906-1704-43c9-a503-759c72ab465e
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: -
Research Description: Download Monitor [download-monitor] < 1.9.7 Download Monitor < 1.9.7 - Unauthenticated Downloading of Logs An Unauthenticated attacker can export download logs from the Plugin. Which includes: Download ID, Version ID, Filename, User ID, User Login, User Email, User IP, User Agent, Date, Status. The information could potentially be used to mount further attacks or just collect contact information.
Affected versions: max 1.9.7.
Status: vulnerable

Download Monitor # dd16eeb637ea9e1a0b8a1c730f904caacef13c83

CVE, Research URL: dd16eeb637ea9e1a0b8a1c730f904caacef13c83
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 08, 2024
Research Description: Download Monitor [download-monitor] < 4.9.5 WordPress Download Monitor Plugin < 4.9.5 is vulnerable to SQL Injection Update the WordPress Download Monitor plugin to the latest available version (at least 4.9.5). WordFence discovered and reported this SQL Injection vulnerability in WordPress Download Monitor Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 4.9.5. Have additional information or questions about this entry? Get in touch.
Affected versions: max 4.9.5.
Status: vulnerable

Download Monitor # 06ca2620530a0a3eeeb0b89da25cdd2a8429fea1

CVE, Research URL: 06ca2620530a0a3eeeb0b89da25cdd2a8429fea1
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Jan 08, 2024
Research Description: Download Monitor [download-monitor] < 4.9.5 Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection The Download Monitor plugin for WordPress is vulnerable to SQL Injection via the 'limit' parameter in all versions up to 4.9.5 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 4.9.5.
Status: vulnerable

Aug 10, 2026

Download Monitor # CVE-2026-16608

CVE, Research URL: CVE-2026-16608
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Aug 08, 2026
Research Description: The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Affected versions: max 5.2.6.
Status: vulnerable

Oct 06, 2026

Download Monitor # CVE-2026-100182

CVE, Research URL: CVE-2026-100182
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 02, 2026
Research Description: The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.
Affected versions: max 5.2.11.
Status: vulnerable

Oct 17, 2026

Download Monitor # CVE-2026-110375

CVE, Research URL: CVE-2026-110375
Home page URL: Security reports for Download Monitor
Application: Download Monitor
Date: Oct 16, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Affected versions: max 5.3.4.
Status: vulnerable