JoomUnited vulnerabilities
We track 4 vulnerabilities in JoomUnited products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest JoomUnited vulnerabilities
- 8.1 High severity
WP File Download: Missing Authorization
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticat
- 8.1 High severity
WP File Download: Improper Limitation of a Pathname to a Restricted Directory
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to d
- 7.2 High severity
WP Meta SEO: Improper Neutralization of Input During Web Page Generation
The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `
- 8.8 High severity
WP Media folder: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.