Plugin icon

Simple Download Monitor

simple-download-monitor

Vulnerabilities:

16

Last Updated:

June 18, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-02-26
Title
Simple Download Monitor < 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
Fixed in
Fixed in 4.0.6
CVSS
6.4 (medium)
Published
2025-08-27
Title
Simple Download Monitor < 3.9.34 - Simple Download Monitor < 3.9.34 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality
Fixed in
Fixed in 3.9.34
CVSS
6.5 (medium)
Published
2025-08-27
Title
Simple Download Monitor < 3.9.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.9.35
CVSS
6.4 (medium)
Published
2025-01-24
Title
Simple Download Monitor < 3.9.26 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 3.9.26
CVSS
4.9 (medium)
Published
2021-12-21
Title
Simple Download Monitor < 3.9.9 - Multiple CSRF
Fixed in
Fixed in 3.9.9
CVSS
5.4 (medium)
Published
2021-12-21
Title
Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes
Fixed in
Fixed in 3.9.11
CVSS
6.8 (medium)
Published
2021-10-05
Title
Simple Download Monitor < 3.9.6 - Unauthorised Log Reset
Fixed in
Fixed in 3.9.6
CVSS
4.3 (medium)
Published
2021-10-05
Title
Simple Download Monitor < 3.9.6 - Unauthenticated Log Access
Fixed in
Fixed in 3.9.6
CVSS
5.3 (medium)
Published
2021-10-05
Title
Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail
Fixed in
Fixed in 3.9.5
CVSS
6.8 (medium)
Published
2021-10-05
Title
Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal
Fixed in
Fixed in 3.9.6
CVSS
5.4 (medium)
Published
2021-10-05
Title
Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.9.5
CVSS
8.8 (high)
Published
2021-09-02
Title
Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal
Fixed in
Fixed in 3.9.5
CVSS
6.5 (medium)
Published
2020-10-21
Title
Simple Download Monitor < 3.8.9 - SQL Injection
Fixed in
Fixed in 3.8.9
CVSS
5.4 (medium)
Published
2020-10-21
Title
Simple Download Monitor < 3.8.9 - Unauthenticated Cross-Site Scripting
Fixed in
Fixed in 3.8.9
CVSS
6.1 (medium)
Published
2018-01-02
Title
Simple Download Monitor <= 3.5.3 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.5.4
CVSS
5.4 (medium)
Published
2016-01-19
Title
Simple Download Monitor <= 3.2.8 - Insufficient Authorisation
Fixed in
Fixed in 3.2.9
CVSS
n/a