CVE-2026-100182
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Download Monitor plugin for WordPress is vulnerable to stored XSS via postMessage to the admin editor. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker can hijack an admin session, steal data, or infect other pages if an admin visits a crafted page and opens the download edit screen.
Recommendation
Update the Download Monitor plugin to the latest patched version. Additionally, restrict admin privileges and apply content security policies.
Other vulnerabilities in Download Monitor
See all- CVE-2026-39489Medium
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
- CVE-2026-39486High
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-4401Medium
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.
Original NVD description (English source)
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS