Download Monitor
Monthly
Download Monitor, a WordPress plugin, fails to verify that a clicked link actually belongs to the site before fetching it client-side and injecting part of the response back into the page, producing a cross-site scripting condition in every release before 5.3.4. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but is gated by mandatory user interaction - an attacker must convince a victim to click a crafted link - and it crosses a trust boundary into the browser, so the injected script runs in the context of the affected WordPress site. A public PoC reference exists but is not verified as working exploit code, EPSS is only 0.24% (14th percentile), and there is no CISA KEV entry, so signals point to a moderate, interaction-gated risk rather than an emergency; the vendor fix is version 5.3.4.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete arbitrary pending orders by manipulating PayPal transaction tokens, allowing theft of paid digital goods. Attackers can pay minimal amounts for low-cost items and use those payment tokens to finalize high-value orders, effectively bypassing payment validation. CVSS 7.5 (High) reflects network-based attack with no authentication required. No public exploit identified at time of analysis, though the attack mechanism is clearly documented in vendor advisories.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.9.4. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.7.60. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.6%.
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.8.1. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Download Monitor, a WordPress plugin, fails to verify that a clicked link actually belongs to the site before fetching it client-side and injecting part of the response back into the page, producing a cross-site scripting condition in every release before 5.3.4. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C) but is gated by mandatory user interaction - an attacker must convince a victim to click a crafted link - and it crosses a trust boundary into the browser, so the injected script runs in the context of the affected WordPress site. A public PoC reference exists but is not verified as working exploit code, EPSS is only 0.24% (14th percentile), and there is no CISA KEV entry, so signals point to a moderate, interaction-gated risk rather than an emergency; the vendor fix is version 5.3.4.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Insecure Direct Object Reference in WP Download Monitor plugin (≤5.1.7) enables unauthenticated attackers to complete arbitrary pending orders by manipulating PayPal transaction tokens, allowing theft of paid digital goods. Attackers can pay minimal amounts for low-cost items and use those payment tokens to finalize high-value orders, effectively bypassing payment validation. CVSS 7.5 (High) reflects network-based attack with no authentication required. No public exploit identified at time of analysis, though the attack mechanism is clearly documented in vendor advisories.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Download Monitor WordPress plugin versions before 5.2.6 fails to enforce authorization on an AJAX download-logging endpoint and simultaneously leaks the nonce that would normally gatekeep it to unauthenticated visitors, enabling arbitrary log injection. Any unauthenticated remote attacker can inject fabricated entries into the plugin's download log to artificially inflate a site's download statistics. Publicly available exploit code exists per WPScan reporting; however, with no CISA KEV listing and an EPSS of 0.14% (3rd percentile), real-world exploitation appears limited to opportunistic or targeted campaigns rather than widespread active abuse.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.9.4. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.7.60. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.6%.
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.8.3. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.8.1. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.