Download Monitor

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 42% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

Recent releases and news for this plugin

1. — Version 5.2.5 Fixed: Download loading indicator styling. Added: The download_data shortcode now supports custom meta fields. 5.2.5
2. — Version 5.2.4 Fixed: Frontend CSS is now always loaded on frontend pages. 5.2.4
3. — Version 5.2.3 Fixed: Default download template link rendering inside lists. 5.2.3
4. — Version 5.2.2 Changed: Title and Filename download templates restored to default link styling. Fixed: Terms & Conditions download behavior and admin list quick edit checkbox. 5.2.2
5. — Version 5.2.1 Improved: File browser modal updated. Fixed: Downloads widget chart on the dashboard showing incorrect data. Fixed: Download title sometimes displayed incorrectly on the Reports page. Fixed: PHP notice shown on some admi 5.2.1
6. — Version 5.2.0 Changed: Improved frontend CSS class naming to avoid conflicts with other plugins. Added: Filter to show extra version fields in the download editor. Fixed: PHP warning related to session handling on hosts with open_base 5.2.0

30 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 Download Monitor <= 5.2.5 - Missing Authorization ↗
   2026-08-03 CVE-2026-16608 Missing Authorization Affects <= 5.2.5 Patched in 5.2.6
2. Medium · 4.3 Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download ↗
   2026-04-20 CVE-2026-39489 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.1.9 Patched in 5.1.10
3. Medium · 5.4 Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling ↗
   2026-04-07 CVE-2026-4401 Cross-Site Request Forgery (CSRF) Affects <= 5.1.10 Patched in 5.1.11
4. High · 7.5 Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' ↗
   2026-03-29 CVE-2026-3124 Authorization Bypass Through User-Controlled Key Affects <= 5.1.7 Patched in 5.1.8
5. Medium · 6.5 Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection ↗
   2026-03-25 CVE-2026-39486 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.1.8 Patched in 5.1.9
6. High · 8.8 Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-05-07 CVE-2025-47439 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 5.0.22 Patched in 5.0.23
7. Medium · 4.3 Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure ↗
   2024-10-29 CVE-2024-10399 Missing Authorization Affects <= 5.0.13 Patched in 5.0.14
8. Medium · 4.3 Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation ↗
   2024-10-25 CVE-2024-10092 Missing Authorization Affects <= 5.0.12 Patched in 5.0.13
9. Medium · 4.3 Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable ↗
   2024-09-25 CVE-2024-8552 Missing Authorization Affects <= 5.0.9 Patched in 5.0.10
10. Medium · 5.4 Download Monitor <= 4.9.13 - Missing Authorization ↗
    2024-05-29 CVE-2024-3269 Improper Authorization Affects <= 4.9.13 Patched in 4.9.14
11. High · 7.2 Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection ↗
    2024-01-08 CVE-2024-30501 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.9.5 Patched in 4.9.5
12. High · 8.8 Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file ↗
    2023-06-07 CVE-2023-34007 Unrestricted Upload of File with Dangerous Type Affects < 4.8.4 Patched in 4.8.4
13. Medium · 5.5 Download Monitor <= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery ↗
    2023-05-30 CVE-2023-31219 Server-Side Request Forgery (SSRF) Affects <= 4.8.1 Patched in 4.8.2
14. Medium · 5.4 Download Monitor <= 4.7.60 - Sensitive Information Exposure via REST API ↗
    2023-05-10 CVE-2022-45354 Missing Authorization Affects <= 4.7.60 Patched in 4.7.70
15. High · 7.5 Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export ↗
    2022-11-26 CVE-2022-4972 Missing Authorization Affects <= 4.7.51 Patched in 4.7.52
16. Medium · 4.9 Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure ↗
    2022-11-01 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 4.7.2 Patched in 4.7.3
17. Medium · 6.8 Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download ↗
    2022-09-19 CVE-2022-2981 Files or Directories Accessible to External Parties Affects <= 4.5.97 Patched in 4.5.98
18. Medium · 4.9 Download Monitor <= 4.5.9 - Authenticated Arbitrary File Download ↗
    2022-06-27 CVE-2022-2222 Files or Directories Accessible to External Parties Affects <= 4.5.9 Patched in 4.5.91
19. Medium · 6.1 Download Monitor <= 4.4.6 - Reflected Cross-Site Scripting ↗
    2021-10-29 CVE-2021-36920 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.6 Patched in 4.4.7
20. Medium · 6.8 Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download ↗
    2021-10-29 CVE-2021-31567 Files or Directories Accessible to External Parties Affects <= 4.4.6 Patched in 4.4.7
21. Medium · 5.5 Download Monitor <= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2021-10-29 CVE-2021-23174 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.4.6 Patched in 4.4.7
22. High · 7.2 Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter ↗
    2021-10-20 CVE-2021-24786 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.4.5 Patched in 4.4.5
23. Medium · 6.5 Download Monitor <= 1.9.6 - Missing Authorization ↗
    2017-05-05 Missing Authorization Affects <= 1.9.6 Patched in 1.9.7
24. Medium · 6.1 Download Monitor < 1.7.1 - Reflected Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9296 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.7.1 Patched in 1.7.1
25. Medium · 6.1 Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.6.5 Patched in 1.6.5
26. Medium · 5.3 Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure ↗
    2015-03-08 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.6.3 Patched in 1.6.4
27. High · 7.2 Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter ↗
    2013-07-23 CVE-2013-5098 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.3.6.2 Patched in 3.3.6.2
28. Medium · 6.1 Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter ↗
    2013-07-22 CVE-2013-3262 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.3.6.2 Patched in 3.3.6.2
29. Medium · 6.1 Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting ↗
    2012-09-06 CVE-2012-4768 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.5.8 Patched in 3.3.5.9
30. Critical · 9.8 Download Monitor <= 2.0.6 - Unauthenticated SQL Injection ↗
    2008-04-28 CVE-2008-2034 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.0.6 Patched in 2.0.9

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 57 languages, 4 at 90% or more

Plus 33 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-08 90K+ → 80K+ down after 663 days in tier
2. 2024-07-14 100K+ → 90K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Download Manager 100K+ installs · 4.1★ · 4 shared tags A
• Download Manager Addons for Elementor 6K+ installs · 3.4★ · 3 shared tags B
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 40K+ installs · 4.7★ · 2 shared tags A
• Document Library Lite 4K+ installs · 3.9★ · 2 shared tags B
• Shared Files – File Upload & Download Manager 4K+ installs · 4.3★ · 2 shared tags A
• Lana Downloads Manager 3K+ installs · 4.5★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for Download Monitor into a readme, a review or a deck. It updates itself.

Download Monitor: 80K+ active installs, 4.5★ (524 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/download-monitor