Skip to content
OpenAdvisories

Vendor

JoomUnited

29 known vulnerabilities.

Products

WP Meta SEO 13 WP File Download 4 WP Media folder 4 WP Table Manager 3 WP Latest Posts 2 WP File Download Light 1 WP Media folder Addon 1 WP Meta SEO (WordPress plugin) 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.1
    CVE-2026-39799

    WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

    JoomUnited WP File Download
  • High 8.1
    CVE-2026-94538

    WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

    The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authentica…

    JoomUnited WP File Download Web / CMS
  • High 7.1
    CVE-2026-32569

    WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

    JoomUnited WP Media folder
  • High 8.1
    CVE-2026-14982

    WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

    The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to …

    JoomUnited WP File Download Web / CMS
  • High 7.2
    CVE-2026-9643

    WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging

    The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates …

    JoomUnited WP Meta SEO Web / CMS
  • High 7.5
    CVE-2026-9690

    WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerability

    Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

    JoomUnited WP Media folder Addon
  • High 7.2
    CVE-2023-6961

    WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header

    The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated atta…

    JoomUnited WP Meta SEO Web / CMS