Missing Authorization
8 records27.6%First: 2017. Latest: 2026.
Plugin security history
Download Monitor Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 29 vulnerability records associated with Download Monitor, published between 2008 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
29Total records
1Critical
7High
21Medium
0Low
0Informational
29Patched records
0Currently marked unpatched
2008-04-28First disclosure
2026-04-20Latest disclosure
25 of 29CVE coverage
Use this history
Check and watch Download Monitor.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2008 | 1 | |
| 2012 | 1 | |
| 2013 | 2 | |
| 2015 | 3 | |
| 2017 | 1 | |
| 2021 | 4 | |
| 2022 | 4 | |
| 2023 | 3 | |
| 2024 | 5 | |
| 2025 | 1 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 3.4% |
| High | 7 | 24.1% |
| Medium | 21 | 72.4% |
Vulnerability-Type Breakdown
Cross-Site Scripting
7 records24.1%First: 2012. Latest: 2021.
Other
5 records17.2%First: 2021. Latest: 2025.
SQL Injection
4 records13.8%First: 2008. Latest: 2026.
Path Traversal
2 records6.9%First: 2022. Latest: 2026.
Information Disclosure
1 record3.4%First: 2015. Latest: 2015.
Arbitrary File Upload
1 record3.4%First: 2023. Latest: 2023.
CSRF
1 record3.4%First: 2026. Latest: 2026.
Patch Status
- Patched
- 29
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
5.1.105.1.115.1.85.1.95.0.235.0.145.0.135.0.104.9.144.9.54.8.44.8.24.7.704.7.524.7.34.5.984.5.914.4.74.4.51.9.71.6.51.7.11.6.43.3.6.23.3.5.92.0.9
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-1.6.3 | Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure | March 8, 2015 | 1.6.4 | Medium |
[*, 3.3.6.2) | Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter | July 23, 2013 | 3.3.6.2 | High |
[*, 3.3.6.2) | Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter | July 22, 2013 | 3.3.6.2 | Medium |
*-3.3.5.8 | Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting | September 6, 2012 | 3.3.5.9 | Medium |
*-2.0.6 | Download Monitor <= 2.0.6 - Unauthenticated SQL Injection | April 28, 2008 | 2.0.9 | Critical |
Selected source records
Latest Records
MediumCVE-2026-39489
Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download
Published: April 20, 2026
- Affected versions
- *-5.1.9
- Patched versions
- 5.1.10
MediumCVE-2026-4401
Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
Published: April 7, 2026
- Affected versions
- *-5.1.10
- Patched versions
- 5.1.11
HighCVE-2026-3124
Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Published: March 29, 2026
- Affected versions
- *-5.1.7
- Patched versions
- 5.1.8
MediumCVE-2026-39486
Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection
Published: March 25, 2026
- Affected versions
- *-5.1.8
- Patched versions
- 5.1.9
HighCVE-2025-47439
Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion
Published: May 7, 2025
- Affected versions
- *-5.0.22
- Patched versions
- 5.0.23
MediumCVE-2024-10399
Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure
Published: October 29, 2024
- Affected versions
- *-5.0.13
- Patched versions
- 5.0.14
MediumCVE-2024-10092
Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation
Published: October 25, 2024
- Affected versions
- *-5.0.12
- Patched versions
- 5.0.13
MediumCVE-2024-8552
Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable
Published: September 25, 2024
- Affected versions
- *-5.0.9
- Patched versions
- 5.0.10
Highest-Severity Records
CriticalCVE-2008-2034
Download Monitor <= 2.0.6 - Unauthenticated SQL Injection
Published: April 28, 2008
- Affected versions
- *-2.0.6
- Patched versions
- 2.0.9
HighCVE-2023-34007
Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file
Published: June 7, 2023
- Affected versions
- [*, 4.8.4)
- Patched versions
- 4.8.4
HighCVE-2025-47439
Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion
Published: May 7, 2025
- Affected versions
- *-5.0.22
- Patched versions
- 5.0.23
HighCVE-2026-3124
Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Published: March 29, 2026
- Affected versions
- *-5.1.7
- Patched versions
- 5.1.8
HighCVE-2022-4972
Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
Published: November 26, 2022
- Affected versions
- *-4.7.51
- Patched versions
- 4.7.52
HighCVE-2024-30501
Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection
Published: January 8, 2024
- Affected versions
- [*, 4.9.5)
- Patched versions
- 4.9.5
HighCVE-2013-5098
Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
Published: July 23, 2013
- Affected versions
- [*, 3.3.6.2)
- Patched versions
- 3.3.6.2
HighCVE-2021-24786
Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter
Published: October 20, 2021
- Affected versions
- [*, 4.4.5)
- Patched versions
- 4.4.5
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.