CVE-2026-112207
CVE-2026-112207 · Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
CVSS 7.1 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
download monitor
- Versiones
- ≥ 0, < 5.3.4: Afectada (semver)
Actualiza a 5.3.4