CVE-2026-112207highCWE-79

CVE-2026-112207: high-severity vulnerability in Download Monitor

Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

Published

Follow this CVE+ Monitor Download Monitor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.1epss 0.2%
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected products
Unknown · Download Monitor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Download Monitor

In the same product, most dangerous first.

CVE-2021-24786HIGHDownload Monitor < 4.4.5 - Admin+ SQL InjectionEPSS 17.3%CVE-2022-2222—Download Monitor < 4.5.91 - Admin+ Arbitrary File DownloadEPSS 1.1%CVE-2022-2981—Download Monitor < 4.5.98 - Admin+ Arbitrary File DownloadEPSS 1.1%CVE-2026-112219MEDIUMDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST RouteEPSS 0.3%CVE-2026-16608MEDIUMDownload Monitor < 5.2.6 - Unauthenticated Download Log InjectionEPSS 0.3%