Media Library File Download

Media Library File Download has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.6, and the most serious one scores 6.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2023.

2 independent researchers contributed these findings, one record each. Media Library File Download is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Media Library File Download vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2023-33999

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

Read the full analysis

Vulnerability Records

3 records
Media Library File Download banner
Latestv2.0.1

Media Library File Download

wpluna

Author

wpluna

4.3(7)
86/100
Last Updated
2026-09-13 (2mo ago)
Active Installs
1,000+
Downloads
24,384
Requires WP
6.5+
Requires PHP
8.1+
Tested up to
WP 7.1.3
Created
2020-05-19 (7y ago)

Media Library File Download adds practical file tools to your WordPress Media Library. Free features Download an original file from its attachment details or edit screen. Export the complete media library you can manage as a ZIP. Replace a file with the same type and extension while preserving its attachment URL. Regenerate image sizes when replacing images. Exports contain original local files, without generated image sizes or attachment metadata. Offloaded files that are unavailable locally cannot be exported. Archive creation requires the PHP ZIP extension and enough temporary disk space and request time for your library. Pro features Download a selection of media files as a ZIP. Download directly from Media Library list rows and thumbnail controls. Import files selected with Google Picker into WordPress. Upload WordPress media to a Google Drive folder you choose. Remember your upload folder and review recent transfer results. Retry failed transfers and move your uploaded copies to Drive trash. Google Drive access is limited to files you select and files this app creates. Choosing a folder does not authorize access to its existing contents. Select individual files to import them. Google Docs, Sheets, Slides, and Drawings import as PDFs; other Google-native file types and shortcuts are unsupported. Google export limits and your WordPress upload limits apply. Keep the transfer tab open until completion. Pro requires a Freemius entitlement, including an eligible trial. Google Drive uses the WP Luna connection service and requires PHP OpenSSL. Each WordPress user clicks Connect Google Drive and signs in to their own Google account. Customers do not need a Google Cloud project or API credentials. External services Freemius provides licensing, updates, and optional account services. It communicates with Freemius according to the SDK’s consent and licensing flow. See https://freemius.com/privacy/ and https://freemius.com/terms/. In Pro, the WP Luna connection service handles Google sign-in and hosts Google Picker. When you connect or select files, your site sends its Freemius installation ID, site URL, a pseudonymous WordPress user identifier, and a signed request to WP Luna. The service verifies Pro entitlement with Freemius and stores encrypted Google authorization per site and WordPress user. Pending connection and selection requests expire after 10 minutes; unused connections expire after 90 days. Disconnect removes the stored connection. No Google client secret or refresh token is distributed with the plugin. The service returns a short-lived Google access token to WordPress and selected file IDs and names from Picker. File contents transfer directly between WordPress and Google Drive. Imports request selected Drive files and metadata; uploads send chosen WordPress file contents, names, and destination IDs. The plugin stores an encrypted connection per WordPress user, a selected folder, and up to 50 recent transfer records. The free package does not load the Google integration. Google policies: https://policies.google.com/privacy and https://policies.google.com/terms.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C