Live › vulnerability › CVE-2026-112207
Go to dashboardThe Download Monitor WordPress plugin before 5.3.4 fetches a clicked link without checking it belongs to the site, then renders part of the response on the page. An unauthenticated attacker who tricks a user into clicking a crafted link can run arbitrary JavaScript in that user's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the Download Monitor WordPress plugin older than 5.3.4 are exposed, since the flaw sits in the plugin's client-side link handling. The sources do not say which plugin features or configurations are required to reach the flaw, so unknown whether all installs are affected. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get download-monitor --field=version5.3.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
This page as .md · .json · in your agent: get_signal("CVE-2026-112207")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.