JoomUnited WP File Download

• CVE-2026-39799 High 7.1 WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2026-94538 High 8.1 WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions 0.2%
• CVE-2026-14975 Medium 6.5 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter 0.9%
• CVE-2026-14982 High 8.1 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter 0.8%