CVE-2026-110375: WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Download Monitor pluginto a version that resolves this vulnerability.Fixed in 5.3.4
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) and has low attack complexity (AC:L).
What could exploitation affect?
Successful exploitation can have low impact on confidentiality, integrity, and availability. The scope is changed (S:C), meaning the impact may extend beyond the vulnerable component's original security authority.
Which Download Monitor versions are affected?
Download Monitor versions through 5.3.3 are affected. The available data does not identify a fixed version.