CVE-2026-112207
UnknownSummary
The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Risk Assessment
An attacker can execute malicious JavaScript in a victim's browser, potentially leading to session theft, data exfiltration, or actions performed on behalf of the user.
Recommendation
Update the Download Monitor plugin to version 5.3.4 or later. Inform users about the risk of clicking unknown links.
Other vulnerabilities in Download Monitor WordPress plugin
See all- CVE-2026-112219Medium
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.
- CVE-2026-16608Medium
The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Original NVD description (English source)
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS