Vulnerabilities

TI-2022-04560 CVE-2022-4972 · GHSA-88wj-fxpv-pc7g

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export

LOW 39

The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00466 Published 2024-10-16 No fix listed CWE-862

TI-2024-07928 CVE-2024-8552 · GHSA-8g3g-h53q-cf7j

Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable

LOW 20

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00368 Published 2024-09-26 No fix listed CWE-862

TI-2024-20225 CVE-2024-30501 · GHSA-mw2p-r2fm-9p6g

WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00609 Published 2024-03-29 No fix listed CWE-89

TI-2022-22320 CVE-2022-45354 · GHSA-gq65-6w6h-w9gj

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

HIGH 66

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.38083 Published 2024-01-08 No fix listed CWE-200

TI-2023-16874 CVE-2023-34007 · GHSA-xjrx-g2f3-92fc

WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00906 Published 2023-12-20 No fix listed CWE-434

TI-2023-14925 CVE-2023-31219 · GHSA-49fm-88jx-9fhr

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

LOW 23

Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00653 Published 2023-11-13 No fix listed CWE-918

TI-2022-02752 CVE-2022-2981 · GHSA-2739-p2pg-h53m

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

LOW 25

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01114 Published 2022-10-10 Fixed in 4.5.98 CWE-552

TI-2022-02051 CVE-2022-2222 · GHSA-hg22-xhfq-mfrq

Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

LOW 25

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01132 Published 2022-07-17 Fixed in 4.5.91 CWE-552

TI-2021-11679 CVE-2021-31567 · GHSA-7q5c-gm5x-mj54

WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

LOW 33

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6).

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.01391 Published 2022-01-28 No fix listed CWE-200

TI-2021-05950 CVE-2021-23174 · GHSA-2523-v9j2-g44c

WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

MEDIUM 63

Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.83853 Published 2022-01-28 No fix listed CWE-79

TI-2021-15000 CVE-2021-36920 · GHSA-6vjf-f548-f65r

WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

LOW 25

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00592 Published 2022-01-14 No fix listed CWE-79

TI-2021-07068 CVE-2021-24786 · GHSA-xgj6-2p43-6fvx

Download Monitor < 4.4.5 - Admin+ SQL Injection

HIGH 73

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.17348 Published 2022-01-03 Fixed in 4.4.5 CWE-89

Vulnerabilities

Filters