Download Monitor (Unknown) - vulnerabilities (CVEs)

6 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-24. Vendor: Unknown.

CVEs of Download Monitor

• CVE-2026-112207 - CVSS 7.1 (high), 2026-10-24: The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and…
• CVE-2026-112219 - CVSS 4.9 (medium), 2026-10-23: The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to…
• CVE-2026-16608 - CVSS 5.3 (medium), 2026-08-08: The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce…
• CVE-2022-2981 - CVSS 4.9 (medium), 2022-10-10: The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high…
• CVE-2022-2222 - CVSS 4.9 (medium), 2022-07-17: The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high…
• CVE-2021-24786 - CVSS 7.2 (high), 2022-01-03: The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when…