7.1
High
CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…
Description
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Download Monitor 5.3 | earliest → < 5.3.4 | 5.3.4 |
Other CVEs of Download Monitor
The 6 CVEs of Download Monitor →
CVE-2026-112219
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem…
4.9
Medium
CVE-2026-16608
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its…
5.3
Medium
CVE-2022-2981
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog…
Not rated
CVE-2022-2222
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog…
Not rated