Plugin security history

Download Monitor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 29 vulnerability records associated with Download Monitor, published between 2008 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

29Total records

1Critical

7High

21Medium

0Low

0Informational

29Patched records

0Currently marked unpatched

2008-04-28First disclosure

2026-04-20Latest disclosure

25 of 29CVE coverage

Use this history

Check and watch Download Monitor.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Download Monitor

Year-by-Year Timeline

Year	Records	Relative volume
2008	1	1 records
2012	1	1 records
2013	2	2 records
2015	3	3 records
2017	1	1 records
2021	4	4 records
2022	4	4 records
2023	3	3 records
2024	5	5 records
2025	1	1 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	1	3.4%
High	7	24.1%
Medium	21	72.4%

Vulnerability-Type Breakdown

Missing Authorization

8 records27.6%

First: 2017. Latest: 2026.

Cross-Site Scripting

7 records24.1%

First: 2012. Latest: 2021.

Other

5 records17.2%

First: 2021. Latest: 2025.

SQL Injection

4 records13.8%

First: 2008. Latest: 2026.

Path Traversal

2 records6.9%

First: 2022. Latest: 2026.

Information Disclosure

1 record3.4%

First: 2015. Latest: 2015.

Arbitrary File Upload

1 record3.4%

First: 2023. Latest: 2023.

CSRF

1 record3.4%

First: 2026. Latest: 2026.

Patch Status

Patched: 29
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.1.10
5.1.11
5.1.8
5.1.9
5.0.23
5.0.14
5.0.13
5.0.10
4.9.14
4.9.5
4.8.4
4.8.2
4.7.70
4.7.52
4.7.3
4.5.98
4.5.91
4.4.7
4.4.5
1.9.7
1.6.5
1.7.1
1.6.4
3.3.6.2
3.3.5.9
2.0.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.1.9`	Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download	April 20, 2026	5.1.10	Medium
`*-5.1.10`	Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling	April 7, 2026	5.1.11	Medium
`*-5.1.7`	Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'	March 29, 2026	5.1.8	High
`*-5.1.8`	Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection	March 25, 2026	5.1.9	Medium
`*-5.0.22`	Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion	May 7, 2025	5.0.23	High
`*-5.0.13`	Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure	October 29, 2024	5.0.14	Medium
`*-5.0.12`	Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation	October 25, 2024	5.0.13	Medium
`*-5.0.9`	Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable	September 25, 2024	5.0.10	Medium
`*-4.9.13`	Download Monitor <= 4.9.13 - Missing Authorization	May 29, 2024	4.9.14	Medium
`[*, 4.9.5)`	Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection	January 8, 2024	4.9.5	High
`[*, 4.8.4)`	Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file	June 7, 2023	4.8.4	High
`*-4.8.1`	Download Monitor <= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery	May 30, 2023	4.8.2	Medium
`*-4.7.60`	Download Monitor <= 4.7.60 - Sensitive Information Exposure via REST API	May 10, 2023	4.7.70	Medium
`*-4.7.51`	Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export	November 26, 2022	4.7.52	High
`*-4.7.2`	Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure	November 1, 2022	4.7.3	Medium
`*-4.5.97`	Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download	September 19, 2022	4.5.98	Medium
`*-4.5.9`	Download Monitor <= 4.5.9 - Authenticated Arbitrary File Download	June 27, 2022	4.5.91	Medium
`*-4.4.6`	Download Monitor <= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting	October 29, 2021	4.4.7	Medium
`*-4.4.6`	Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download	October 29, 2021	4.4.7	Medium
`*-4.4.6`	Download Monitor <= 4.4.6 - Reflected Cross-Site Scripting	October 29, 2021	4.4.7	Medium
`[*, 4.4.5)`	Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter	October 20, 2021	4.4.5	High
`*-1.9.6`	Download Monitor <= 1.9.6 - Missing Authorization	May 5, 2017	1.9.7	Medium
`1.7.0`	Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting	April 20, 2015	1.6.5, 1.7.1	Medium
`[*, 1.6.5)`	Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting	April 20, 2015	1.6.5, 1.7.1	Medium
`[*, 1.7.1)`	Download Monitor < 1.7.1 - Reflected Cross-Site Scripting	April 20, 2015	1.7.1	Medium

Selected source records

Latest Records

MediumCVE-2026-39489

Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download

Published: April 20, 2026

Affected versions: *-5.1.9
Patched versions: 5.1.10

Original Wordfence record

MediumCVE-2026-4401

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling

Published: April 7, 2026

Affected versions: *-5.1.10
Patched versions: 5.1.11

Original Wordfence record

HighCVE-2026-3124

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

Published: March 29, 2026

Affected versions: *-5.1.7
Patched versions: 5.1.8

Original Wordfence record

MediumCVE-2026-39486

Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection

Published: March 25, 2026

Affected versions: *-5.1.8
Patched versions: 5.1.9

Original Wordfence record

HighCVE-2025-47439

Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion

Published: May 7, 2025

Affected versions: *-5.0.22
Patched versions: 5.0.23

Original Wordfence record

MediumCVE-2024-10399

Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure

Published: October 29, 2024

Affected versions: *-5.0.13
Patched versions: 5.0.14

Original Wordfence record

MediumCVE-2024-10092

Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation

Published: October 25, 2024

Affected versions: *-5.0.12
Patched versions: 5.0.13

Original Wordfence record

MediumCVE-2024-8552

Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable

Published: September 25, 2024

Affected versions: *-5.0.9
Patched versions: 5.0.10

Original Wordfence record

Highest-Severity Records

CriticalCVE-2008-2034

Download Monitor <= 2.0.6 - Unauthenticated SQL Injection

Published: April 28, 2008

Affected versions: *-2.0.6
Patched versions: 2.0.9

Original Wordfence record

HighCVE-2023-34007

Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file

Published: June 7, 2023

Affected versions: [*, 4.8.4)
Patched versions: 4.8.4

Original Wordfence record

HighCVE-2025-47439

Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion

Published: May 7, 2025

Affected versions: *-5.0.22
Patched versions: 5.0.23

Original Wordfence record

HighCVE-2026-3124

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'

Published: March 29, 2026

Affected versions: *-5.1.7
Patched versions: 5.1.8

Original Wordfence record

HighCVE-2022-4972

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export

Published: November 26, 2022

Affected versions: *-4.7.51
Patched versions: 4.7.52

Original Wordfence record

HighCVE-2024-30501

Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection

Published: January 8, 2024

Affected versions: [*, 4.9.5)
Patched versions: 4.9.5

Original Wordfence record

HighCVE-2013-5098

Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter

Published: July 23, 2013

Affected versions: [*, 3.3.6.2)
Patched versions: 3.3.6.2

Original Wordfence record

HighCVE-2021-24786

Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter

Published: October 20, 2021

Affected versions: [*, 4.4.5)
Patched versions: 4.4.5

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory