Advisories · Technology

wpchill Download Monitor.

Every CVE that names wpchill Download Monitor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-100182 CVE record

CVSS 7.2 High

Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
- wpchill Download Monitor
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-4401 CVE record

CVSS 5.4 Medium

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
- wpchill Download Monitor
- Cross-site request forgery (CSRF)
Not analysed yet 7 Apr 2026
CVE-2026-3124 CVE record

CVSS 7.5 High

Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
- wpchill Download Monitor
- Broken access control
Not analysed yet 30 Mar 2026
CVE-2024-10399 CVE record

CVSS 4.3 Medium

Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure
- wpchill Download Monitor
- Broken access control
Not analysed yet 30 Oct 2024
CVE-2024-10092 CVE record

CVSS 4.3 Medium

Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation
- wpchill Download Monitor
- Broken access control
Not analysed yet 26 Oct 2024
CVE-2022-4972 CVE record

CVSS 7.5 High

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
- wpchill Download Monitor
- Broken access control
Not analysed yet 16 Oct 2024
CVE-2024-8552 CVE record

CVSS 4.3 Medium

Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable
- wpchill Download Monitor
- Broken access control
Not analysed yet 26 Sept 2024
CVE-2024-3269 CVE record

CVSS 5.4 Medium

Download Monitor <= 4.9.13 - Missing Authorization
- wpchill Download Monitor
- Broken access control
Not analysed yet 30 May 2024
CVE-2024-30501 CVE record

CVSS 7.6 High

WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability
- WPChill Download Monitor
- SQL injection
Not analysed yet 29 Mar 2024
CVE-2022-45354 CVE record

CVSS 5.3 Medium

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
- WPChill Download Monitor
- Information disclosure
Not analysed yet 8 Jan 2024
CVE-2023-34007 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload
- WPChill Download Monitor
- Unrestricted file upload
Not analysed yet 20 Dec 2023
CVE-2023-31219 CVE record

CVSS 4.1 Medium

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)
- WPChill Download Monitor
- Server-side request forgery (SSRF)
Not analysed yet 13 Nov 2023
CVE-2021-23174 CVE record

CVSS 3.4 Low

WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
- WPChill Download Monitor
- Cross-site scripting (XSS)
Not analysed yet 28 Jan 2022