Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2026-110375

WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Download Monitor Download Monitor
CVE-2026-100182

Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Download Monitor Download Monitor
CVE-2026-39486

WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2024-30501

WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2023-34007

WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2023-31219

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2022-45354

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.

CVSS 3.1 · 5.3 Medium EPSS 38.1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2026-3124

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2024-3269

Download Monitor <= 4.9.13 - Missing Authorization

The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2024-10092

Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2024-10399

Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2026-4401

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpchill
Products
Wordpress Download Monitor
CVE-2022-4972

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export

The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2024-8552

Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2021-24786

Download Monitor < 4.4.5 - Admin+ SQL Injection

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue

CVSS 3.1 · 7.2 High EPSS 17.3% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2021-31567

WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.

CVSS 3.1 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2021-36920

WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2021-23174

WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].

CVSS 3.1 · 3.4 Low EPSS 83.9% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor
CVE-2022-2981

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Wpchill
Products
Download Monitor