Media Downloader
Media Downloader has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).
Every one of the 3 issues recorded for Media Downloader has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Media Downloader is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-24684Media Downloader <= 0.4.7.5 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Media Downloader
Author
Ederson Peka
Note: Updating from versions prior to 0.3 requires reactivating! Media Downloader plugin lists MP3 files from a folder through the [mediadownloader] shortcode. It reads MP3 information directly from the files. It also can try to get rid of stupid content blockers (mainly corporatives), changing all links to .MP3 files into some download URL without the string “MP3”.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C