EUVD-2026-109224

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

PT-2026-122501

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

CVE-2026-112219

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...

EUVD-2026-108596

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...

PT-2022-5019

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.5.98 Description The issue is related to insufficient protection of registration data, allowing a remote attacker to disclose protected information. High privilege users, such as admins, ca...

Arbitrary file deletion

Authenticated admin+ Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6. The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadablefileurls0 parameter data. It's also...

PT-2022-10037

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions = 4.4.6 Description The issue allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the downloadable file urls0 parameter data. It is also possibl...