CVE-2026-112207: Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
Published Oct 24, 2026
·Updated
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Affected Software
1 affected component
Download Monitor Download Monitor<5.3.4
Event History
Oct 24, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue, and what user interaction is required?
An unauthenticated attacker can exploit it by convincing any user to click a crafted link. The JavaScript executes in the browser of the user who clicks the link.
2
Which installations are affected?
Download Monitor versions before 5.3.4 are affected. The issue is in client-side handling of clicked download links that are not validated as belonging to the site.