Joomunited
Vulnerability activity for Joomunited: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighOct 10, 2026Joomunited WP File Download XSSCVE-2026-39799Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
- 8.1HighOct 10, 2026JoomUnited WP File Download Auth bypass / access controlCVE-2026-94538The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, move files between categories, and publish or unpublish arbitrary files.
- 7.1HighOct 6, 2026Joomunited WP Media folder XSSCVE-2026-32569Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
- 6.5MediumSep 5, 2026JoomUnited WP File Download Path traversal / file handlingCVE-2026-14975The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, af
Top products
- WP File Download3 CVEs in the last year
- WP Media folder1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.