WordPress Avenir-Soft Direct Download plugin version 1.0 suffers from cross site request forgery and cross site scripting vulnerabilities.