Skip to content
PluginCanary

Download Monitor

by WP Chill · 80,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 4 Nov 2026, 57 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Download Monitor
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Quick answers

Is Download Monitor still maintained?
Yes. Last release 4 Nov 2026, 57 releases in the last 24 months. 4 Nov 2026 · wordpress.org
Who owns Download Monitor, and has it changed hands?
No change recorded. Main committer raldea89 since Feb 2022. 4 Nov 2026 · SVN log
Was Download Monitor removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Download Monitor safe?
34 known vulnerabilities, all fixed (latest in 5.3.5). Not on the exploited list. 23 Oct 2026 · Wordfence Intelligence
Is the latest Download Monitor update safe to install?
No ownership change before 5.3.7. No one-star spike after it. 4 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
barrykooij8 Jan 2015 to 15 Mar 2021, 59 commits
cristian.raiber29 Mar 2021 to 29 Mar 2021, 1 commits
giucu9128 Jul 2021 to 30 Sep 2022, 19 commits
raldea8916 Feb 2022 to 28 Nov 2024, 132 commits
wpchill21 Aug 2024 to 6 Nov 2025, 41 commits
altesin14 Feb 2025 to 4 Nov 2026, 44 commits

6 committers recorded. No ownership change since 2007.

Maintenance

Last release
today
Releases, 24 months
57
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Download Monitor
Q1 20246
Q2 20242
Q3 202413
Q4 20248
Q1 20253
Q2 20254
Q3 202511
Q4 20253
Q1 20266
Q2 20265
Q3 202613
Q4 20266

Last release 4 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (1 review). Lifetime: 4.5.

Average rating per quarter for Download Monitor
Q4 20245.0
Q1 20255.0
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20264.5
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q4 2024 and Q4 2026.

Rating distribution
5 star435
4 star31
3 star9
2 star9
1 star41

Security record

10 vulnerabilities in 24 months (34 on record), all patched (latest fixed in 5.3.5).

Show 34 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
23 Oct 2026Download Monitor < 5.3.5 - Missing Authorization2.7< 5.3.55.3.5Patched before disclosure
22 Oct 2026Download Monitor <= 5.3.3 - Reflected Cross-Site Scripting6.1<= 5.3.35.3.4Patched before disclosure
15 Oct 2026Download Monitor <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 5.3.35.3.4Patched before disclosure
1 Oct 2026Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor7.2<= 5.2.105.2.11Patched before disclosure
3 Aug 2026Download Monitor <= 5.2.5 - Missing Authorization5.3<= 5.2.55.2.6Patched before disclosure
20 Apr 2026Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download4.3<= 5.1.95.1.10Patched before disclosure
7 Apr 2026Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling5.4<= 5.1.105.1.11Patched before disclosure
29 Mar 2026Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'7.5<= 5.1.75.1.8Patched before disclosure
25 Mar 2026Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection6.5<= 5.1.85.1.9Patched before disclosure
7 May 2025Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion8.8<= 5.0.225.0.23Patched before disclosure
29 Oct 2024Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure4.3<= 5.0.135.0.14Patched before disclosure
25 Oct 2024Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation4.3<= 5.0.125.0.13Patched before disclosure
25 Sep 2024Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable4.3<= 5.0.95.0.10Patched before disclosure
29 May 2024Download Monitor <= 4.9.13 - Missing Authorization5.4<= 4.9.134.9.14Patched before disclosure
8 Jan 2024Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection7.2< 4.9.54.9.5Patched before disclosure
7 Jun 2023Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file8.8< 4.8.44.8.4Patched before disclosure
30 May 2023Download Monitor <= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery5.5<= 4.8.14.8.21
10 May 2023Download Monitor <= 4.7.60 - Sensitive Information Exposure via REST API5.4<= 4.7.604.7.70Patched before disclosure
26 Nov 2022Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export7.5<= 4.7.514.7.52Patched before disclosure
1 Nov 2022Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure4.9<= 4.7.24.7.3Patched before disclosure
19 Sep 2022Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download6.8<= 4.5.974.5.98Patched before disclosure
27 Jun 2022Download Monitor <= 4.5.9 - Authenticated Arbitrary File Download4.9<= 4.5.94.5.91Patched before disclosure
29 Oct 2021Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download6.8<= 4.4.64.4.7Patched before disclosure
29 Oct 2021Download Monitor <= 4.4.6 - Reflected Cross-Site Scripting6.1<= 4.4.64.4.7Patched before disclosure
29 Oct 2021Download Monitor <= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting5.5<= 4.4.64.4.7Patched before disclosure

Changelog mentions of security fixes: 5.2.6 (security); 5.2.11 (security); 5.3.4 (security); 5.3.5 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 4 support threads resolved in the last 2 months.

Momentum

80,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Download Monitor
4 May 20267,599
11 May 20268,826
18 May 202637,246
25 May 20266,948
1 Jun 20264,964
8 Jun 202631,133
15 Jun 202634,953
22 Jun 20267,364
29 Jun 20265,660
6 Jul 202658,260
13 Jul 202662,039
20 Jul 20269,212
27 Jul 202660,236
3 Aug 202610,986
10 Aug 20265,071
17 Aug 20265,234
24 Aug 20264,587
31 Aug 202632,617
7 Sep 202635,278
14 Sep 20269,492
21 Sep 202636,845
28 Sep 202662,549
5 Oct 202662,249
12 Oct 202636,867
19 Oct 202640,958
26 Oct 202641,184
2 Nov 20261,917

Weekly downloads over the last 4 weeks are 13% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Pdf EmbedScore 100 · 10,000+PDF Viewer Block for GutenbergScore 100 · 10,000+Embed PDF ViewerScore 96 · 20,000+PDF EmbedderScore 94 · 300,000+flowpaperScore 93 · 10,000+

Facts

Version5.3.7
AuthorWP Chill
Added12 Mar 2008
Last updated4 Nov 2026
Active installs80,000+
Requires WordPress6.4
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping > Digital Products & Downloads
Tagsecommerce, file manager, digital store, download manager, password protection

Other plugins by this author: Modula Image Gallery - Photo Grid & Video Gallery, Strong Testimonials, Remove Footer Credit, Image Photo Gallery Final Tiles Grid, Passster - Password Protect Pages and Content, Kali Forms - Contact Form & Drag-and-Drop Builder, Htaccess File Editor - Easily Edit, Backup, Restore .htaccess file, CPO Content Types, Gallery PhotoBlocks, RSVP and Event Management, Qyrr - simply and modern QR-Code creation, Wider Admin Menu

Questions

Is Download Monitor still maintained?

Yes. Last release 4 Nov 2026, 57 releases in the last 24 months.

Who owns Download Monitor, and has it changed hands?

No change recorded. Main committer raldea89 since Feb 2022.

Was Download Monitor removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Download Monitor safe?

34 known vulnerabilities, all fixed (latest in 5.3.5). Not on the exploited list.

Is the latest Download Monitor update safe to install?

No ownership change before 5.3.7. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue