Wpchill

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Wpchill product.

RSS Feeds for Wpchill security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Wpchill products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Wpchill Sorted by Most Security Vulnerabilities since 2018

Wpchill Download Monitor17 vulnerabilities

Wpchill Strong Testimonials12 vulnerabilities

Wpchill Passster8 vulnerabilities

Wpchill Check Log Email3 vulnerabilities

Wpchill Remove Footer Credit3 vulnerabilities

Wpchill Gallery Photoblocks3 vulnerabilities

Wpchill Cpo Shortcodes2 vulnerabilities

Wpchill Simple Restrict2 vulnerabilities

Wpchill Customizable Wordpress Gallery Plugin Modula Image Gallery1 vulnerability

Wpchill Htaccess File Editor1 vulnerability

Wpchill Image Photo Gallery Final Tiles Grid1 vulnerability

Wpchill Imageseo1 vulnerability

Wpchill Kb Support1 vulnerability

Wpchill Mashshare1 vulnerability

Wpchill Optimize Images Alt Text Alt Tag Names Seo Using Ai1 vulnerability

Wpchill Cpo Content Types1 vulnerability

Wpchill Rsvp And Event Management1 vulnerability

Wpchill Social Media Share Buttons Mashshare1 vulnerability

Wpchill Brilliance1 vulnerability

By the Year

In 2026 there have been 11 vulnerabilities in Wpchill with an average score of 6.1 out of ten. Last year, in 2025 Wpchill had 18 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Wpchill in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.

Year	Vulnerabilities	Average Score
2026	11	6.08
2025	18	6.05
2024	22	5.64
2023	13	6.89
2022	15	5.37
2021	2	6.65
2020	1	0.00

It may take a day or so for new Wpchill vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Wpchill Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-3239	Apr 08, 2026	Strong Testimonials WP Plugin 3.2.21 Stored XSS via testimonial_view shortcode The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, and including, 3.2.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Strong Testimonials
CVE-2026-4401	Apr 07, 2026	WordPress DM <=5.1.10 CSRF via actions_handler() The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class-dlm-downloads-path.php` in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	Download Monitor
CVE-2026-3124	Mar 30, 2026	Insecure Direct Object Reference in Download Monitor <=5.1.7 executePayment() The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.	Download Monitor
CVE-2026-3584	Mar 20, 2026	Kali Forms WP Plugin RCE via form_process (<=2.4.9) The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
CVE-2026-1860	Feb 18, 2026	Kali Forms WP Plugin 2.4.8 IDOR via get_items_permissions_check The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_items_permissions_check()` permission callback on the `/kaliforms/v1/forms/{id}` REST API endpoint only checking for the `edit_posts` capability without verifying that the requesting user has ownership or authorization over the specific form resource. This makes it possible for authenticated attackers, with Contributor-level access and above, to read form configuration data belonging to other users (including administrators) by enumerating form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.
CVE-2026-1254	Feb 14, 2026	WP Modula <=2.13.6 Auth Bypass via REST API The Modula Image Gallery Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery.
CVE-2026-25036	Feb 03, 2026	WP Chill Passster <=4.2.25 Missing Auth, ACL Bypass Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through <= 4.2.25.	Passster
CVE-2026-24957	Feb 03, 2026	WP Chill Strong Testimonials Missing Auth Vulnerability 3.2.20 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.	Strong Testimonials
CVE-2025-14865	Jan 28, 2026	WP Passster Plg Stored XSS via content_protector short 4.2.24 The Passster Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.2.21.	Passster
CVE-2025-15466	Jan 19, 2026	WP Image Photo Gallery Final Tiles Grid Plugin 3.6.9 AJAX Cap Check Bypass The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
CVE-2025-14632	Jan 17, 2026	Filr WP Plugin 1.2.11 Stored XSS via Unrestricted File Upload (Admin Only) The Filr Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.
CVE-2025-14426	Dec 30, 2025	The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.	Strong Testimonials
CVE-2025-13693	Dec 21, 2025	Image Photo Gallery Final Tiles Grid <=3.6.8 XSS via Custom scripts The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-14455	Dec 19, 2025	WP IPGF Final Tiles Grid v3.6.7 Authorization Bypass (contributor+) The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.
CVE-2025-64218	Dec 18, 2025	WP Chill Passster <=4.2.19 Sensitive Data Exfil by Content-Protector Insertion of Sensitive Information Into Sent Data vulnerability in WP Chill Passster content-protector allows Retrieve Embedded Sensitive Data.This issue affects Passster: from n/a through <= 4.2.19.	Passster
CVE-2025-14003	Dec 15, 2025	Image Gallery Plugin <2.13.3: Author+ Unauthorized Add Images The Image Gallery Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.
CVE-2025-13891	Dec 12, 2025	WordPress Modula <=2.13.3 Path Traversal via modula_list_folders AJAX The Image Gallery Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
CVE-2025-13646	Dec 03, 2025	Modula Image Gallery WP Plugin 2.13.12.13.2: Arbitrary File Upload (Auth) The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.
CVE-2025-13645	Dec 03, 2025	Modula Img Gallery WP v2.13.1-2.13.2: File Deletion via ajax_unzip_file The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2025-12494	Nov 15, 2025	Image Gallery (Photo Grid & Video) arbitrary file deletion before 2.12.28 The Image Gallery Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.
CVE-2025-11268	Nov 06, 2025	Strong Testimonials <=3.2.16 Arbitrary Shortcode Execution The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.	Strong Testimonials
CVE-2025-57926	Sep 22, 2025	WP Chill Passster <=4.2.18 Stored XSS Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through <= 4.2.18.	Passster
CVE-2025-7367	Jul 15, 2025	Strong Testimonials WP Plugin 3.2.11 – Stored XSS via Custom Fields (Author Auth) The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Strong Testimonials
CVE-2024-9416	Apr 03, 2025	Modula Image Gallery XSS via FancyBox <=5.0.36 (WP Plugin) The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5.0.36) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-6261	Feb 27, 2025	Stored XSS in Final Tiles Grid WP plugin 3.6.0 via FinalTilesGallery shortcode The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-26975	Feb 25, 2025	Strong Testimonials <=3.2.3 Missing Auth ACL WP Chill WordPress Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.	Strong Testimonials
CVE-2024-12853	Jan 08, 2025	Modula Image Gallery WP CVE-2024-12853: RCE via Auth File Upload (2.11.10) The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2024-12711	Jan 07, 2025	Unauth Deletion via Bulk AJAX in RSVP & Event Manager v2.7.13 The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
CVE-2024-11282	Jan 07, 2025	Passster WP Plugin v<=4.2.10 SIE via WP Search The Passster Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.	Passster
CVE-2024-11106	Dec 10, 2024	WordPress Simple Restrict Plugin Sensitive Information Exposure Vulnerability The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.	Simple Restrict
CVE-2024-49256	Nov 01, 2024	WPChill Htaccess File Editor 1.0.18 Incorrect Authorization Vulnerability Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.	Htaccess File Editor
CVE-2024-47362	Nov 01, 2024	WPChill Strong Testimonials 3.1.16: Missing Authorization Vulnerability in Access Control Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.	Strong Testimonials
CVE-2024-10399	Oct 30, 2024	Download Monitor <=5.0.13: Cap Check Leak Sub Access The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.	Download Monitor
CVE-2024-10092	Oct 26, 2024	Unauthorized API Key Modification in Download Monitor WP plugin up to v5.0.12 The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.	Download Monitor
CVE-2022-4972	Oct 16, 2024	Download Monitor 4.7.51 REST API Auth Bypass The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.	Download Monitor
CVE-2022-4974	Oct 16, 2024	Freemius SDK <=2.4.2 CVE-2022-4974: CSRF & Info Disclosure The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.	Gallery Photoblocks Passster
CVE-2024-8552	Sep 26, 2024	Download Monitor <=5.0.9 allows Subscriber to enable shop via enable_shop() The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality.	Download Monitor
CVE-2024-6571	Jul 24, 2024	WP OptimizeImages v3.1.1 Full Path Disclosure via generate-default.php The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.	Optimize Images Alt Text Alt Tag Names Seo Using Ai Imageseo
CVE-2024-3710	Jul 13, 2024	XSS in Image Photo Gallery Final Tiles Grid WP plugin <3.6.0 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin	Image Photo Gallery Final Tiles Grid
CVE-2023-6491	Jun 07, 2024	Auth Attacker Modifies Views in Strong Testimonials <=3.1.12 The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.	Strong Testimonials
CVE-2024-3269	May 30, 2024	WordPress Download Monitor 4.9.13 Unauth. Uninstall via missing Capability check The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data.	Download Monitor
CVE-2024-3261	Apr 24, 2024	Stored XSS in Strong Testimonials WP plugin before 3.1.12 The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed	Strong Testimonials
CVE-2024-32429	Apr 15, 2024	WPChill Remove Footer Credit <=1.0.13: Stored XSS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue affects Remove Footer Credit: from n/a through 1.0.13.	Remove Footer Credit
CVE-2024-2026	Apr 09, 2024	Passster WP Plugin 4.2.6.4 XSS via content_protector Shortcode The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Passster
CVE-2024-30501	Mar 29, 2024	SQLI in WPChill Download Monitor <=4.9.4 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.	Download Monitor
CVE-2024-1083	Mar 13, 2024	Sensitive Info Exposure via REST API in Simple Restrict WP Plugin <=1.2.6 The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content	Simple Restrict
CVE-2024-0616	Feb 29, 2024	Passster Password Protect Plugin <4.2.6.2 Sensitive Info Exposure via API The Passster Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.2 via API. This makes it possible for unauthenticated attackers to obtain post titles, slugs, IDs, content and other metadata including passwords of password-protected posts and pages.	Passster
CVE-2024-1218	Feb 29, 2024	Kali Forms <2.3.41 REST Endpoints: Unauth Data Mod via API The Contact Form builder with drag & drop for WordPress Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
CVE-2024-1217	Feb 29, 2024	Kali Forms 2.3.41 Unauthorized Plugin Deactivation Vulnerability The Contact Form builder with drag & drop for WordPress Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
CVE-2022-45354	Jan 08, 2024	WPChill Download Monitor <=4.7.60: Sensitive Info Disclosure to Unauthorized Actor Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.	Download Monitor