Download Monitor vulnerabilities

The Download Monitor plugin for WordPress is vulnerable to stored XSS via postMessage to the admin editor. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.

The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.