CVE-2026-110375
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WP Chill Download Monitor plugin contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.3.3.
Risk Assessment
This may allow an attacker to inject malicious script that executes in a user's browser, posing a risk to session confidentiality and site integrity.
Recommendation
Update the Download Monitor plugin to a version newer than 5.3.3 if available.
Other vulnerabilities in Download Monitor
See all- CVE-2026-100182High
The Download Monitor plugin for WordPress is vulnerable to stored XSS via postMessage to the admin editor. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.
- CVE-2026-39489Medium
In Download Monitor versions <= 5.1.9, there is a vulnerability that allows unauthorized users to download arbitrary files.
- CVE-2026-39486High
The Download Monitor plugin for WordPress up to version 5.1.8 has a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.
- CVE-2026-4401Medium
The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS