CVE-2026-39799

Unauthenticated Cross Site Scripting XSS in WP File Download = 6.3.6 versions...

CVE-2026-39799 WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP File Download = 6.3.6 versions...

CVE-2026-39799

The WP File Download WordPress plugin (versions

EUVD-2026-96532

Unauthenticated Cross Site Scripting XSS in WP File Download = 6.3.6 versions...

CVE-2026-94538

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-96217

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-94538

The WP File Download plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 6.3.9 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This allows authenticated attackers with subscriber-level a...

CVE-2026-94538 WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-109751

Name of the Vulnerable Software and Affected Versions WP File Download versions prior to 6.3.7 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendatio...

CVE-2026-94538: Missing Authorization

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-39799: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP File Download = 6.3.6 versions...

WordPress WP File Download plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Deletion/Modification vulnerability discovered by t4g0 in WordPress Plugin WP File Download versions = 6.3.9...

CVE-2026-94664 WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

CVE-2026-94664

The PDF for Contact Form 7 WordPress plugin (versions 7.1.0 and below ) is vulnerable to a Path Traversal vulnerability (CWE-22). This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. Exploitation details regarding specific vector...

CVE-2026-94666

The ZealousWeb Generate PDF using Contact Form 7 WordPress plugin (versions n/a through 4.2.1 ) is vulnerable to a Path Traversal vulnerability. This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. No specific remediation steps o...

CVE-2026-94666 WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

PT-2026-108108

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The file-upload component incorporates the FilePond PHP server, which includes an index.php file exposing a fetch API route. This route allows the server to download an arbitrary URL using cu...

CVE-2026-92533

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

CVE-2026-92533 Path Traversal in BugTracker.NET

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

CVE-2026-92533

A path traversal vulnerability exists in the BugTracker.NET file download component. The flaw stems from improper validation of user-supplied paths in the parameter used to specify file names. An authenticated remote attacker could provide a manipulated path to access files outside the intended d...