Download Monitor
Monthly
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete arbitrary pending orders by manipulating PayPal transaction tokens, allowing theft of paid digital goods. Attackers can pay minimal amounts for low-cost items and use those payment tokens to finalize high-value orders, effectively bypassing payment validation. CVSS 7.5 (High) reflects network-based attack with no authentication required. No public exploit identified at time of analysis, though the attack mechanism is clearly documented in vendor advisories.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.9.4. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.7.60. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.6%.
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.8.1. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete arbitrary pending orders by manipulating PayPal transaction tokens, allowing theft of paid digital goods. Attackers can pay minimal amounts for low-cost items and use those payment tokens to finalize high-value orders, effectively bypassing payment validation. CVSS 7.5 (High) reflects network-based attack with no authentication required. No public exploit identified at time of analysis, though the attack mechanism is clearly documented in vendor advisories.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.9.4. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.7.60. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.6%.
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.8.1. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.