Plugin security history

Simple Download Monitor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 17 vulnerability records associated with Simple Download Monitor, published between 2016 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

17Total records

2Critical

2High

13Medium

0Low

0Informational

17Patched records

0Currently marked unpatched

2016-01-19First disclosure

2026-02-26Latest disclosure

15 of 17CVE coverage

Use this history

Check and watch Simple Download Monitor.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Simple Download Monitor

Year-by-Year Timeline

Year	Records	Relative volume
2016	1	1 records
2018	2	2 records
2020	2	2 records
2021	8	8 records
2025	3	3 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	2	11.8%
High	2	11.8%
Medium	13	76.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records47.1%

First: 2018. Latest: 2026.

SQL Injection

3 records17.6%

First: 2020. Latest: 2025.

Missing Authorization

2 records11.8%

First: 2016. Latest: 2021.

Path Traversal

1 record5.9%

First: 2021. Latest: 2021.

Privilege Escalation

1 record5.9%

First: 2021. Latest: 2021.

Information Disclosure

1 record5.9%

First: 2021. Latest: 2021.

CSRF

1 record5.9%

First: 2021. Latest: 2021.

Patch Status

Patched: 17
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.0.6
3.9.35
3.9.34
3.9.26
3.9.11
3.9.9
3.9.6
3.9.5
3.8.9
3.3.9
3.5.4
3.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.0.5`	Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field	February 26, 2026	4.0.6	Medium
`*-3.9.34`	Simple Download Monitor <= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 27, 2025	3.9.35	Medium
`*-3.9.33`	Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality	August 27, 2025	3.9.34	Medium
`*-3.9.25`	Simple Download Monitor <= 3.9.25 - Authenticated (Administrator+) SQL Injection	January 24, 2025	3.9.26	Medium
`*-3.9.10`	Simple Download Monitor <= 3.9.10 - Contributor+ Stored Cross-Site Scripting via Shortcodes	December 21, 2021	3.9.11	Medium
`*-3.9.8`	Simple Download Monitor <= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities	December 21, 2021	3.9.9	High
`[*, 3.9.5)`	Simple Download Monitor <= 3.9.4 - Reflected Cross-Site Scripting	October 5, 2021	3.9.5	Medium
`*-3.9.5`	Simple Download Monitor <= 3.9.5 - Log Reset	October 5, 2021	3.9.6	Medium
`[*, 3.9.6)`	Simple Download Monitor <= 3.9.5 - Sensitive Data Exposure	October 5, 2021	3.9.6	Medium
`[*, 3.9.6)`	Simple Download Monitor <= 3.9.5 - Contributor+ Arbitrary Thumbnail Removal	October 5, 2021	3.9.6	Medium
`*-3.9.4`	Simple Download Monitor <= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail	October 5, 2021	3.9.5	Critical
`[*, 3.9.5)`	Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download	September 2, 2021	3.9.5	Medium
`*-3.8.8`	Simple Download Monitor <= 3.8.8 - SQL Injection	October 21, 2020	3.8.9	High
`*-3.3.8`	Simple Download Monitor <= 3.8.8 - Unauthenticated Stored Cross-Site Scripting	October 21, 2020	3.3.9	Medium
`[*, 3.5.4)`	Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting	January 2, 2018	3.5.4	Medium
`[*, 3.5.4)`	Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting	January 2, 2018	3.5.4	Medium
`*-3.2.8`	Simple Download Monitor <= 3.2.8 - Missing Authorization	January 19, 2016	3.2.9	Critical

Selected source records

Latest Records

MediumCVE-2026-2383

Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

Published: February 26, 2026

Affected versions: *-4.0.5
Patched versions: 4.0.6

Original Wordfence record

MediumCVE-2025-8977

Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality

Published: August 27, 2025

Affected versions: *-3.9.33
Patched versions: 3.9.34

Original Wordfence record

MediumCVE-2025-58197

Simple Download Monitor <= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: August 27, 2025

Affected versions: *-3.9.34
Patched versions: 3.9.35

Original Wordfence record

MediumCVE-2025-24663

Simple Download Monitor <= 3.9.25 - Authenticated (Administrator+) SQL Injection

Published: January 24, 2025

Affected versions: *-3.9.25
Patched versions: 3.9.26

Original Wordfence record

HighCVE-2021-24696

Simple Download Monitor <= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities

Published: December 21, 2021

Affected versions: *-3.9.8
Patched versions: 3.9.9

Original Wordfence record

MediumCVE-2021-24694

Simple Download Monitor <= 3.9.10 - Contributor+ Stored Cross-Site Scripting via Shortcodes

Published: December 21, 2021

Affected versions: *-3.9.10
Patched versions: 3.9.11

Original Wordfence record

CriticalCVE-2021-24693

Simple Download Monitor <= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

Published: October 5, 2021

Affected versions: *-3.9.4
Patched versions: 3.9.5

Original Wordfence record

MediumCVE-2021-24698

Simple Download Monitor <= 3.9.5 - Contributor+ Arbitrary Thumbnail Removal

Published: October 5, 2021

Affected versions: [*, 3.9.6)
Patched versions: 3.9.6

Original Wordfence record

Highest-Severity Records

Critical

Simple Download Monitor <= 3.2.8 - Missing Authorization

Published: January 19, 2016

Affected versions: *-3.2.8
Patched versions: 3.2.9

Original Wordfence record

CriticalCVE-2021-24693

Simple Download Monitor <= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail

Published: October 5, 2021

Affected versions: *-3.9.4
Patched versions: 3.9.5

Original Wordfence record

HighCVE-2021-24696

Simple Download Monitor <= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities

Published: December 21, 2021

Affected versions: *-3.9.8
Patched versions: 3.9.9

Original Wordfence record

HighCVE-2020-5651

Simple Download Monitor <= 3.8.8 - SQL Injection

Published: October 21, 2020

Affected versions: *-3.8.8
Patched versions: 3.8.9

Original Wordfence record

MediumCVE-2025-8977

Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality

Published: August 27, 2025

Affected versions: *-3.9.33
Patched versions: 3.9.34

Original Wordfence record

MediumCVE-2021-24692

Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download

Published: September 2, 2021

Affected versions: [*, 3.9.5)
Patched versions: 3.9.5

Original Wordfence record

MediumCVE-2018-5212

Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting

Published: January 2, 2018

Affected versions: [*, 3.5.4)
Patched versions: 3.5.4

Original Wordfence record

MediumCVE-2026-2383

Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field

Published: February 26, 2026

Affected versions: *-4.0.5
Patched versions: 4.0.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory