Read the docs

Metagauss

Records164All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical12CVSS 9.0–10.0
CVSS high71CVSS 7.0–8.9

Exploited now

Metagauss records in CISA KEV

No Metagauss vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Profilegrid 35 records HIGH Registrationmagic 34 records HIGH Eventprime 27 records MEDIUM Download Plugin 5 records HIGH Download Theme 1 record LOW Leadmagic 1 record LOW Themeflection Numbers 1 record MEDIUM

Records

5 records in Download Plugin · all components

TI-2025-05982 CVE-2025-6586 · GHSA-p6jc-rpjm-5w6x

Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload

Priority HIGH 67

The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in all versions up to, and including, 2.2.8.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01264 Published 2025-07-04 No fix listed CWE-434
TI-2021-07337 CVE-2021-25059 · GHSA-3wxf-wxw2-g5hj

Download Plugin < 2.0.0 - Subscriber+ Website Download

Priority MEDIUM 58

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscr…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00688 Published 2022-11-28 Fixed in 2.0.0
TI-2024-09122 CVE-2024-9829 · GHSA-75p4-7w59-h695

Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download

Priority LOW 29

The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' and 'dpwap_handle_download_comment' functions in all versions u…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00411 Published 2024-10-23 No fix listed CWE-862
TI-2021-06985 CVE-2021-24703 · GHSA-xh2m-j2x9-vffg

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

Priority LOW 26

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are alr…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00398 Published 2021-11-23 Fixed in 1.6.1 CWE-732
Open these records in search →