Is Download Monitor safe?

Every recorded flaw

• Oct 24, 2026Download Monitor: Does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the pageCVE-2026-112207 · fixed in 5.3.4 · reported by WPScanHigh 7.1
• Oct 23, 2026Download Monitor: Does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisiteCVE-2026-112219 · fixed in 5.3.5 · reported by WPScanMedium 4.9
• Oct 15, 2026Download Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110375 · affects up to 5.3.3 · reported by PatchstackMedium 6.5
• Oct 2, 2026Download Monitor: Stored Cross-Site ScriptingCVE-2026-100182 · affects up to 5.2.10 · reported by WordfenceHigh 7.2
• Aug 8, 2026Download Monitor: Does not perform authorization checks on one of its download-logging AJAX actionsCVE-2026-16608 · fixed in 5.2.6 · reported by WPScanMedium 5.3
• Jun 15, 2026Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.CVE-2026-39489 · affects up to 5.1.9 · reported by PatchstackMedium 4.4
• Apr 8, 2026Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39486 · affects up to 5.1.8 · reported by PatchstackHigh 8.5
• Apr 7, 2026Download Monitor: Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-pathCVE-2026-4401 · affects up to 5.1.10 · reported by WordfenceMedium 5.4
• Mar 29, 2026Download Monitor: Insecure Direct Object ReferenceCVE-2026-3124 · affects up to 5.1.7 · reported by WordfenceHigh 7.5
• May 7, 2025Download Monitor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47439 · affects up to 5.0.22 · reported by PatchstackHigh 7.5
• Oct 30, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10399 · affects up to 5.0.13 · reported by WordfenceMedium 4.3
• Oct 26, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10092 · affects up to 5.0.12 · reported by WordfenceMedium 4.3
• Oct 16, 2024Download Monitor: Authorization bypassCVE-2022-4972 · affects up to 4.7.51 · reported by WordfenceHigh 7.5
• Sep 25, 2024Download Monitor: Unauthorized modification of dataCVE-2024-8552 · affects up to 5.0.9 · reported by WordfenceMedium 4.3
• May 30, 2024Download Monitor: Unauthorized access to functionalityCVE-2024-3269 · affects up to 4.9.13 · reported by WordfenceMedium 5.4
• Jan 8, 2024Download Monitor: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-45354 · affects up to 4.7.60 · reported by Patchstack38% oddsMedium 5.3
• Dec 20, 2023Download Monitor: Unrestricted Upload of File with Dangerous TypeCVE-2023-34007 · affects up to 4.8.3 · reported by PatchstackCritical 9.9
• Nov 12, 2023Download Monitor: Server-Side Request Forgery (SSRF)CVE-2023-31219 · affects up to 4.8.1 · reported by PatchstackMedium 4.1
• Oct 10, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2981 · fixed in 4.5.98 · reported by WPScan1.1% oddsMedium 4.9
• Jul 17, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2222 · fixed in 4.5.91 · reported by WPScan1.1% oddsMedium 4.9
• Jan 28, 2022Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6).CVE-2021-31567 · affects up to 4.4.6 · reported by Patchstack1.4% oddsMedium 6.8
• Jan 28, 2022Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameCVE-2021-23174 · affects up to 4.4.6 · reported by Patchstack84% oddsLow 3.4
• Jan 14, 2022Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).CVE-2021-36920 · affects up to 4.4.6 · reported by PatchstackMedium 4.8
• Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · fixed in 4.4.5 · reported by WPScan17% oddsHigh 7.2
• Aug 13, 2019The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.CVE-2015-9296 · fixed in 1.7.1 · reported by MITREMedium 6.1
• Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-5098 · fixed in 3.3.6.2 · reported by MITRE2.0% oddsMedium 4.3
• Aug 9, 2013Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrCVE-2013-3262 · fixed in 3.3.6.2 · reported by PSIRT-CNA@flexerasoftware.com2.1% oddsMedium 4.3

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.