{"id":"CVE-2026-112207","kind":"vulnerability","aliases":["CVE-2026-112207"],"related":[],"title":"Download Monitor WordPress plugin: crafted link runs JavaScript in visitors' browsers","description":"The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.","summary":"The Download Monitor WordPress plugin before 5.3.4 fetches a clicked link without checking it belongs to the site, then renders part of the response on the page. An unauthenticated attacker who tricks a user into clicking a crafted link can run arbitrary JavaScript in that user's browser.","severity":"medium","cvss":null,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["download-monitor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Download Monitor plugin version in the WordPress admin under Plugins, or with `wp plugin get download-monitor --field=version`\n- unknown for other checks","fix":"- Update the Download Monitor plugin to `5.3.4` or later\n- unknown for other actions","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:57+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Download Monitor plugin to `5.3.4` or later\n- unknown for other actions","reach":"internet","title":"Download Monitor WordPress plugin: crafted link runs JavaScript in visitors' browsers","impact":"medium","summary":"The Download Monitor WordPress plugin before 5.3.4 fetches a clicked link without checking it belongs to the site, then renders part of the response on the page. An unauthenticated attacker who tricks a user into clicking a crafted link can run arbitrary JavaScript in that user's browser.","category":"package","nicknames":[],"who_cares":["wordpress","download-monitor","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript in a logged-in user's browser","analyst_note":"Confirm the affected version range and the vulnerable feature or setting from the plugin changelog or the vendor advisory, and whether admin users are reachable by the crafted link.","how_to_check":"- Check the installed Download Monitor plugin version in the WordPress admin under Plugins, or with `wp plugin get download-monitor --field=version`\n- unknown for other checks","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Download Monitor WordPress plugin older than 5.3.4 are exposed, since the flaw sits in the plugin's client-side link handling. The sources do not say which plugin features or configurations are required to reach the flaw, so unknown whether all installs are affected. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3319,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112207':14A,17A '-2026':13A,16A '5.3.4':32B,80C 'allow':109C 'arbitrari':67B,114C 'attack':55B,111C 'belong':40B,89C 'browser':11A,73B,118C 'check':38B 'click':35B,61B,87C,126C 'client':97C 'client-sid':96C 'craft':5A,63B,128C 'cve':12A,15A 'download':1A,19B,27B,75C 'download-monitor':18B 'execut':113C 'fetch':33B,94C 'host':24B 'javascript':8A,68B,115C 'link':6A,36B,64B,88C,129C 'monitor':2A,20B,28B,76C 'packag':21B 'page':52B,107C 'part':46B,101C 'plugin':4A,30B,78C 'proper':83C 'render':45B,100C 'respons':49B,104C 'run':7A,66B 'self':23B 'self-host':22B 'side':98C 'site':43B,92C 'trick':57B,124C 'unauthent':54B,110C 'user':59B,71B,121C 'valid':84C 'visitor':10A 'without':37B 'wordpress':3A,25B,29B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Download Monitor WordPress plugin older than 5.3.4 are exposed, since the flaw sits in the plugin's client-side link handling. The sources do not say which plugin features or configurations are required to reach the flaw, so unknown whether all installs are affected. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112207","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112207","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112207","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}