All packages
Download Monitor vulnerabilities
3 known CVE vulnerabilities in Download Monitor, translated and rated.
- CVE-2026-39489Medium
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
- CVE-2026-39486High
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-4401Medium
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.