Known vulnerabilities in Download Monitor

Powerful Download Manager Plugin for WordPress

30Reported vulnerabilities

9.8Highest CVSS score

5.2.7Latest version

80,000+Active installs

What to do now

Update Download Monitor to 5.2.6 or later. 30 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-23174	Medium 4.8	83.9%	Before 4.4.7	`4.4.7`	January 28, 2022
CVE-2022-45354	Medium 5.4	38.1%	4.7.60 and earlier	`4.7.70`	May 10, 2023
CVE-2021-24786	High 7.2	17.3%	Before 4.4.5	`4.4.5`	January 3, 2022
CVE-2012-4768	Medium 4.3	10.5%	3.3.5.7 to 3.3.5.7 (inclusive)	`3.3.5.9`	September 4, 2014
CVE-2008-2034	Critical 9.8	1.9%	2.0.6 and earlier	`2.0.9`	April 28, 2008
CVE-2022-2222	Medium 4.9	1.1%	Before 4.5.91	`4.5.91`	July 17, 2022
CVE-2023-34007	High 8.8	0.9%	Before 4.8.4	`4.8.4`	June 7, 2023
CVE-2022-2981	Medium 4.9	0.9%	Before 4.5.98	`4.5.98`	October 10, 2022
CVE-2013-3262	Medium 4.3	2.1%	1.0.6 and earlier 1.0.0 to 1.0.0 (inclusive) 1.0.1 to 1.0.1 (inclusive) 1.0.2 to 1.0.2 (inclusive) 1.0.3 to 1.0.3 (inclusive) 1.0.4 to 1.0.4 (inclusive) 1.0.5 to 1.0.5 (inclusive)	`3.3.6.2`	August 9, 2013
CVE-2025-47439	High 8.8	0.7%	5.0.22 and earlier	`5.0.23`	May 7, 2025
CVE-2026-3124	High 7.5	0.3%	0 to 5.1.7 (inclusive)	`5.1.8`	March 30, 2026
CVE-2022-4972	High 7.5	0.5%	4.7.51 and earlier	`4.7.52`	October 16, 2024
CVE-2024-30501	High 7.2	0.6%	Before 4.9.5	`4.9.5`	January 8, 2024
CVE-2021-31567	Medium 6.8	1.4%	4.4.6 and earlier	`4.4.7`	January 28, 2022
CVE-2026-39486	Medium 6.5	0.3%	5.1.8 and earlier	`5.1.9`	March 25, 2026
WF-c320e437-c1b4-4ccf-9dfd-55ba9c810534	Medium 6.5	—	1.9.6 and earlier	`1.9.7`	May 5, 2017
CVE-2015-9296	Medium 6.1	0.9%	Before 1.7.1	`1.7.1`	August 13, 2019
WF-93cb6d59-6654-4ce1-b65f-0e162ae58bac	Medium 6.1	—	Before 1.6.5 1.7.0 to 1.7.0 (inclusive)	`1.6.5`	April 20, 2015
CVE-2023-31219	Medium 5.5	0.7%	4.8.1 and earlier	`4.8.2`	May 30, 2023
CVE-2024-3269	Medium 5.4	0.3%	0 to 4.9.13 (inclusive)	`4.9.14`	May 30, 2024
CVE-2021-36920	Medium 5.4	0.6%	4.4.6 and earlier	`4.4.7`	January 14, 2022
CVE-2026-16608	Medium 5.3	0.2%	5.2.5 and earlier	`5.2.6`	August 3, 2026
CVE-2026-4401	Medium 5.4	0.2%	0 to 5.1.10 (inclusive)	`5.1.11`	April 8, 2026
WF-f71ab7bb-886a-4661-92b5-d9ac52901494	Medium 5.3	—	1.6.3 and earlier	`1.6.4`	March 8, 2015
WF-4f7fa5a4-07d7-4815-b393-871568777b0f	Medium 4.9	—	4.7.2 and earlier	`4.7.3`	November 1, 2022
CVE-2013-5098	Medium 4.3	2.0%	1.0.6 and earlier 1.0.0 to 1.0.0 (inclusive) 1.0.1 to 1.0.1 (inclusive) 1.0.2 to 1.0.2 (inclusive) 1.0.3 to 1.0.3 (inclusive) 1.0.4 to 1.0.4 (inclusive) 1.0.5 to 1.0.5 (inclusive)	`3.3.6.2`	August 9, 2013
CVE-2026-39489	Medium 4.3	0.3%	5.1.9 and earlier	`5.1.10`	April 20, 2026
CVE-2024-10399	Medium 4.3	0.4%	0 to 5.0.13 (inclusive)	`5.0.14`	October 30, 2024
CVE-2024-10092	Medium 4.3	0.5%	0 to 5.0.12 (inclusive)	`5.0.13`	October 26, 2024
CVE-2024-8552	Medium 4.3	0.4%	Before 5.0.10	`5.0.10`	September 26, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.