Vulnerabilities and security researches fordownload-monitor download-monitor
Direction: descendingOct 17, 2026
Download Monitor # CVE-2026-110375
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
- Affected versions
-
max 5.3.4.
- Status
-
vulnerable
Oct 06, 2026
Download Monitor # CVE-2026-100182
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 02, 2026
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.
- Affected versions
-
max 5.2.11.
- Status
-
vulnerable
Aug 10, 2026
Download Monitor # CVE-2026-16608
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 08, 2026
- Research Description
- The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
- Affected versions
-
max 5.2.6.
- Status
-
vulnerable
Jun 15, 2026
Download Monitor # 98f6fe3c1e368e45554e8dd81d73b2ced1540fae
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 11, 2016
- Research Description
- Download Monitor [download-monitor] < 1.6.4 WordPress Download Monitor Plugin <= 1.6.3 - Authenticated Directory Listing This plugin is prone to an authenticated directory listing vulnerability. It allows attackers list sever side files and directories. Update the plugin.
- Affected versions
-
max 1.6.4.
- Status
-
vulnerable
Download Monitor # 7a142941e5d14e8bc2a1b469281c9ada144d4cc9
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 07, 2023
- Research Description
- Download Monitor [download-monitor] < 4.8.4 Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file The Download Monitor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and access controls on the 'upload_file' function in versions up to, and including, 4.8.3. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Affected versions
-
max 4.8.4.
- Status
-
vulnerable
Download Monitor # 46ca7cde9bef3abc841ab15d24d25f29bc88cd2b
- CVE, Research URL
- Home page URL
- Application
- Date
- May 05, 2017
- Research Description
- Download Monitor [download-monitor] < 1.9.7 Download Monitor <= 1.9.6 - Missing Authorization The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the delete_logs() and export_logs() functions in versions up to, and including, 1.9.6. This makes it possible for unauthenticated attackers to delete and export several log types.
- Affected versions
-
max 1.9.7.
- Status
-
vulnerable
Download Monitor # f5860b327086138ba7c86b4d57c3f4d6b08a8b4e
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 20, 2015
- Research Description
- Download Monitor [download-monitor] <= 1.6.4 Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting The Download Monitor plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on remove_query_arg and add_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 1.6.4.
- Status
-
vulnerable
Download Monitor # fbe2588da943f9426ce5fe110b52bfe2fe5d4913
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 26, 2022
- Research Description
- Download Monitor [download-monitor] < 4.7.52 Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
- Affected versions
-
max 4.7.52.
- Status
-
vulnerable
Download Monitor # 2ff027fefc6d9b0e352553c7601d08f067184608
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 01, 2022
- Research Description
- Download Monitor [download-monitor] < 4.7.3 Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure The Download Monitor plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.7.2 via the list_files function. This allows users with manage_downloads permissions to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected versions
-
max 4.7.3.
- Status
-
vulnerable
Download Monitor # 938246df9c6e64214f96199eb617b2dfc97b1cae
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 09, 2023
- Research Description
- Download Monitor [download-monitor] < 4.7.70 Download Monitor <= 4.7.60 - Missing Authorization to Authenticated Data Export The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to an insufficient capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.60. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to view user data and other sensitive information intended for administrators.
- Affected versions
-
max 4.7.70.
- Status
-
vulnerable
Download Monitor # 42d98bd63f604359ece14631c2b162a4de1526a1
- CVE, Research URL
- Home page URL
- Application
- Date
- May 15, 2015
- Research Description
- Download Monitor [download-monitor] < 1.7.1 WordPress Download Monitor Plugin <= 1.7.0 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.
- Affected versions
-
max 1.7.1.
- Status
-
vulnerable
Download Monitor # a84882a0-5b18-49dd-9be3-a1d92045d5a9
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Download Monitor [download-monitor] < 1.6.4 Download Monitor < 1.6.4 - Authenticated Directory Listing Directory listing vulnerability that can lead to information disclosure. Authenticated users can list sever side files and directories.
- Affected versions
-
max 1.6.4.
- Status
-
vulnerable
Download Monitor # c996842b5799f2226e6f8eaefa8141467ad4bf5c
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 08, 2015
- Research Description
- Download Monitor [download-monitor] < 1.6.4 Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure The Download Monitor plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.6.3 via the 'dir' parameter. This can allow authenticated attackers to extract sensitive data including directories and otherwise restricted server-side filenames.
- Affected versions
-
max 1.6.4.
- Status
-
vulnerable
Download Monitor # a9d39906-1704-43c9-a503-759c72ab465e
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Download Monitor [download-monitor] < 1.9.7 Download Monitor < 1.9.7 - Unauthenticated Downloading of Logs An Unauthenticated attacker can export download logs from the Plugin. Which includes: Download ID, Version ID, Filename, User ID, User Login, User Email, User IP, User Agent, Date, Status. The information could potentially be used to mount further attacks or just collect contact information.
- Affected versions
-
max 1.9.7.
- Status
-
vulnerable
Download Monitor # dd16eeb637ea9e1a0b8a1c730f904caacef13c83
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 08, 2024
- Research Description
- Download Monitor [download-monitor] < 4.9.5 WordPress Download Monitor Plugin < 4.9.5 is vulnerable to SQL Injection Update the WordPress Download Monitor plugin to the latest available version (at least 4.9.5). WordFence discovered and reported this SQL Injection vulnerability in WordPress Download Monitor Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 4.9.5. Have additional information or questions about this entry? Get in touch.
- Affected versions
-
max 4.9.5.
- Status
-
vulnerable
Download Monitor # 06ca2620530a0a3eeeb0b89da25cdd2a8429fea1
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 08, 2024
- Research Description
- Download Monitor [download-monitor] < 4.9.5 Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection The Download Monitor plugin for WordPress is vulnerable to SQL Injection via the 'limit' parameter in all versions up to 4.9.5 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.9.5.
- Status
-
vulnerable
May 02, 2026
Download Monitor # CVE-2026-39489
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Download Monitor [download-monitor] < 5.1.10 CVE-2026-39489
- Affected versions
-
max 5.1.10.
- Status
-
vulnerable
Apr 14, 2026
Download Monitor # CVE-2026-3124
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 30, 2026
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.
- Affected versions
-
max 5.1.8.
- Status
-
vulnerable
Download Monitor # CVE-2026-4401
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 08, 2026
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 5.1.11.
- Status
-
vulnerable
Download Monitor # CVE-2026-39486
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 08, 2026
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.
- Affected versions
-
max 5.1.9.
- Status
-
vulnerable
May 09, 2025
Download Monitor # CVE-2025-47439
- CVE, Research URL
- Home page URL
- Application
- Date
- May 07, 2025
- Research Description
- Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through <= 5.0.22.
- Affected versions
-
max 5.0.23.
- Status
-
vulnerable
Oct 31, 2024
Download Monitor # CVE-2024-10399
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 30, 2024
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
- Affected versions
-
max 5.0.14.
- Status
-
vulnerable
Oct 27, 2024
Download Monitor # CVE-2024-10092
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 26, 2024
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.
- Affected versions
-
max 5.0.13.
- Status
-
vulnerable
Oct 18, 2024
Download Monitor # CVE-2022-4972
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2024
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
- Affected versions
-
max 4.7.52.
- Status
-
vulnerable
Sep 26, 2024
Download Monitor # CVE-2024-8552
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 26, 2024
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.
- Affected versions
-
max 5.0.10.
- Status
-
vulnerable
Jun 06, 2024
Download Monitor # CVE-2021-24786
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 03, 2022
- Research Description
- The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
- Affected versions
-
max 4.4.5.
- Status
-
vulnerable
Download Monitor # CVE-2015-9296
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 13, 2019
- Research Description
- The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
- Affected versions
-
max 1.7.1.
- Status
-
vulnerable
Download Monitor # CVE-2021-36920
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 15, 2022
- Research Description
- Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).
- Affected versions
-
max 4.4.7.
- Status
-
vulnerable
Download Monitor # CVE-2008-1646
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 02, 2008
- Research Description
- SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.
- Affected versions
-
max 1.2.1.
- Status
-
vulnerable
Download Monitor # CVE-2021-23174
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2022
- Research Description
- Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
- Affected versions
-
max 4.4.7.
- Status
-
vulnerable
Download Monitor # CVE-2021-31567
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2022
- Research Description
- Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
- Affected versions
-
max 4.4.7.
- Status
-
vulnerable
Download Monitor # CVE-2012-4768
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 04, 2014
- Research Description
- Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.
- Affected versions
-
max 3.3.5.9.
- Status
-
vulnerable
Download Monitor # CVE-2008-2034
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 30, 2008
- Research Description
- SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Affected versions
-
max 2.0.9.
- Status
-
vulnerable
Download Monitor # CVE-2022-2222
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 17, 2022
- Research Description
- The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
- Affected versions
-
max 4.5.91.
- Status
-
vulnerable
Download Monitor # CVE-2022-2981
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 11, 2022
- Research Description
- The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
- Affected versions
-
max 4.5.98.
- Status
-
vulnerable
Download Monitor # CVE-2022-45354
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 09, 2024
- Research Description
- Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
- Affected versions
-
max 4.7.70.
- Status
-
vulnerable
Download Monitor # CVE-2023-31219
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 13, 2023
- Research Description
- Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.
- Affected versions
-
max 4.8.2.
- Status
-
vulnerable
Download Monitor # CVE-2013-3262
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 10, 2013
- Research Description
- Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.
- Affected versions
-
max 3.3.6.2.
- Status
-
vulnerable
Download Monitor # CVE-2013-5098
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 10, 2013
- Research Description
- Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.
- Affected versions
-
max 3.3.6.2.
- Status
-
vulnerable
Download Monitor # CVE-2023-34007
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 21, 2023
- Research Description
- Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
- Affected versions
-
max 4.8.4.
- Status
-
vulnerable
Download Monitor # CVE-2024-30501
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 29, 2024
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
- Affected versions
-
max 4.9.5.
- Status
-
vulnerable
Download Monitor # CVE-2024-3269
- CVE, Research URL
- Home page URL
- Application
- Date
- May 30, 2024
- Research Description
- The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.
- Affected versions
-
max 4.9.14.
- Status
-
vulnerable