# cve.now: Joomunited

The newest entries naming Joomunited as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-39799](https://cve.now/CVE-2026-39799.md): WordPress WP File Download plugin \<= 6.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-94538](https://cve.now/CVE-2026-94538.md): WP File Download \<= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions (CVSS 8.1)
- [CVE-2026-32569](https://cve.now/CVE-2026-32569.md): WordPress WP Media folder plugin \<= 6.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-14975](https://cve.now/CVE-2026-14975.md): WP File Download \<= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter (CVSS 6.5)
- [CVE-2026-14982](https://cve.now/CVE-2026-14982.md): WP File Download \<= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter (CVSS 8.1)
- [CVE-2026-9620](https://cve.now/CVE-2026-9620.md): WP Latest Posts \<= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute (CVSS 6.4)
- [CVE-2026-9643](https://cve.now/CVE-2026-9643.md): WP Meta SEO \<= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI in 404 Logging (CVSS 7.2)
- [CVE-2026-11370](https://cve.now/CVE-2026-11370.md): WP Meta SEO \<= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new\_link' Parameter (CVSS 6.4)
- [CVE-2026-9690](https://cve.now/CVE-2026-9690.md): WordPress WP Media folder Addon plugin \<= 4.0.1 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2024-13374](https://cve.now/CVE-2024-13374.md): WP Table Manager \<= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure (CVSS 4.3)
- [CVE-2022-47601](https://cve.now/CVE-2022-47601.md): WordPress WP Table Manager plugin \<= 3.5.2 - Broken Access Control (CVSS 5.3)
- [CVE-2024-45455](https://cve.now/CVE-2024-45455.md): WordPress WP Meta SEO plugin \<= 4.5.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-45456](https://cve.now/CVE-2024-45456.md): WordPress WP Meta SEO plugin \<= 4.5.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4135](https://cve.now/CVE-2024-4135.md): WP Latest Posts \<= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2023-6961](https://cve.now/CVE-2023-6961.md): WP Meta SEO \<= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header (CVSS 7.2)
- [CVE-2023-6962](https://cve.now/CVE-2023-6962.md): WP Meta SEO \<= 4.5.12 - Information Exposure via Meta Description (CVSS 5.3)
- [CVE-2024-32539](https://cve.now/CVE-2024-32539.md): WordPress WP File Download Light plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-25907](https://cve.now/CVE-2024-25907.md): WordPress WP Media folder plugin \<= 5.7.2 - Plugin Settings Change vulnerability (CVSS 5.4)
- [CVE-2024-25908](https://cve.now/CVE-2024-25908.md): WordPress WP Media folder plugin \<= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability (CVSS 4.3)
- [CVE-2024-25909](https://cve.now/CVE-2024-25909.md): WordPress WP Media folder Plugin \<= 5.7.2 is vulnerable to Arbitrary File Upload (CVSS 9.9)
- [CVE-2022-47602](https://cve.now/CVE-2022-47602.md): WordPress WP Table Manager Plugin \<= 3.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-1022](https://cve.now/CVE-2023-1022.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation' (CVSS 5.4)
- [CVE-2023-1023](https://cve.now/CVE-2023-1023.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'saveSitemapSettings' (CVSS 5.4)
- [CVE-2023-1024](https://cve.now/CVE-2023-1024.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'regenerateSitemaps' (CVSS 4.3)
- [CVE-2023-1026](https://cve.now/CVE-2023-1026.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'listPostsCategory' (CVSS 4.3)
- [CVE-2023-1027](https://cve.now/CVE-2023-1027.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap' (CVSS 4.3)
- [CVE-2023-1028](https://cve.now/CVE-2023-1028.md): WP Meta SEO \<= 4.5.3 - Cross-Site Request Forgery via 'setIgnore' (CVSS 4.3)
- [CVE-2023-1029](https://cve.now/CVE-2023-1029.md): WP Meta SEO \<= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps' (CVSS 4.3)
- [CVE-2022-30337](https://cve.now/CVE-2022-30337.md): WordPress WP Meta SEO plugin \<= 4.4.8 - Social Settings Update vis Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/joomunited
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.