Download Monitor WordPress plugin vulnerabilities

The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.

The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.