Joomunited vulnerabilities
29 CVEs and advisories name Joomunited as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-39799WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-94538WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
- CVE-2026-32569WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-14975WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
- CVE-2026-14982WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
- CVE-2026-9620WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
- CVE-2026-9643WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
- CVE-2026-11370WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
- CVE-2026-9690WordPress WP Media folder Addon plugin <= 4.0.1 - Arbitrary File Download vulnerability
- CVE-2024-13374WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure
- CVE-2022-47601WordPress WP Table Manager plugin <= 3.5.2 - Broken Access Control
- CVE-2024-45455WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-45456WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-4135WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2023-6961WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header
- CVE-2023-6962WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description
- CVE-2024-32539WordPress WP File Download Light plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-25907WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerability
- CVE-2024-25908WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability
- CVE-2024-25909WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload
- CVE-2022-47602WordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-1022WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'
- CVE-2023-1023WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings'
- CVE-2023-1024WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps'
- CVE-2023-1026WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'
- CVE-2023-1027WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap'
- CVE-2023-1028WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'
- CVE-2023-1029WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps'
- CVE-2022-30337WordPress WP Meta SEO plugin <= 4.4.8 - Social Settings Update vis Cross-Site Request Forgery (CSRF) vulnerability