Metagauss Download Plugin — known CVE vulnerabilities

Every CVE whose affected-product data names Metagauss Download Plugin, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2025-6586 — CVSS 7.2 (high): The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
• CVE-2024-9829 — CVSS 6.5 (medium): The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the…
• CVE-2021-24703 — CVSS 5.7 (medium): The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action…
• CVE-2021-25059 — CVSS 4.3 (medium): The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce…
• CVE-2022-36345 — CVSS 4.3 (medium): Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.