What’s Vulnerable › Products

wpchill Download Monitor vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your wpchill Download Monitor version is affected

Latest wpchill Download Monitor vulnerabilities

• CVE-2026-112207 — Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link (CVSS 7.1)
• CVE-2026-112219 — Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route (CVSS 4.9)
• CVE-2026-110375 — WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-100182 — Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor (CVSS 7.2)
• CVE-2026-16608 — Download Monitor < 5.2.6 - Unauthenticated Download Log Injection (CVSS 5.3)
• CVE-2026-39489 — WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability (CVSS 4.4)
• CVE-2026-39486 — WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2026-4401 — Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling (CVSS 5.4)
• CVE-2026-3124 — Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' (CVSS 7.5)
• CVE-2025-47439 — WordPress Download Monitor plugin <= 5.0.22 - Local File Inclusion Vulnerability (CVSS 7.5)
• CVE-2024-10399 — Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
• CVE-2024-10092 — Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation (CVSS 4.3)
• CVE-2022-4972 — Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export (CVSS 7.5)
• CVE-2024-8552 — Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable (CVSS 4.3)
• CVE-2024-3269 — Download Monitor <= 4.9.13 - Missing Authorization (CVSS 5.4)
• CVE-2024-30501 — WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability (CVSS 7.2)
• CVE-2022-45354 — WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure (CVSS 7.5)
• CVE-2023-34007 — WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload (CVSS 8.8)
• CVE-2023-31219 — WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.9)
• CVE-2022-2981 — Download Monitor < 4.5.98 - Admin+ Arbitrary File Download (CVSS 4.9)
• CVE-2022-2222 — Download Monitor < 4.5.91 - Admin+ Arbitrary File Download (CVSS 4.9)
• CVE-2021-31567 — WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability (CVSS 6.8)
• CVE-2021-23174 — WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
• CVE-2021-36920 — WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2021-24786 — Download Monitor < 4.4.5 - Admin+ SQL Injection (CVSS 7.2)