7.1
Élevée
CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…
Description
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Download Monitor 5.3 | premières → < 5.3.4 | 5.3.4 |
Autres CVE de Download Monitor
Les 6 CVE de Download Monitor →
CVE-2026-112219
The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem…
4.9
Moyenne
CVE-2026-16608
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its…
5.3
Moyenne
CVE-2022-2981
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog…
Non notée
CVE-2022-2222
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog…
Non notée