Joomunited has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.1 (high). Most affected products: WP File Download (2), wp-media-folder (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-94538High· 8.1The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.945CVE-2026-39799High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.39CVE-2026-32569High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.39
Joomunited vulnerabilities
CVEs affecting Joomunited, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-39799High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
CVE-2026-94538High· 8.1The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9
The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it p…
CVE-2026-32569High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.