{
 "id": "WPSEC-2026-1004",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1004/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1004/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1004/index.md",
 "title": "Download Monitor <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via XHR Download Link Handling",
 "description": "The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its front-end XHR download handler in versions 4.6.0 up to, and including, 5.3.3. This is due to the handler fetching any link whose URL merely contains the download endpoint string and trusting the response: its status text was written into the page with innerHTML (403/404) or used as a navigation target (401), and its x-dlm-redirect header was also used as a navigation target, so a javascript: URL could be supplied. This makes it possible for unauthenticated attackers who can place a link on the site, such as in a comment or as a comment author URL, to point it at a server they control that permits the cross-origin request, executing arbitrary web scripts in the site's context when a user clicks the link. Before 4.7.72 only links with the download-link or download-button class were handled, which requires contributor-level access.",
 "plugin": {
  "slug": "download-monitor",
  "name": "Download Monitor",
  "full_name": "Download Monitor",
  "wordpress_org": "https://wordpress.org/plugins/download-monitor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/download-monitor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/download-monitor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.6.0",
    "from_inclusive": true,
    "to": "5.3.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.6.0 before 5.3.4"
  ]
 },
 "introduced_in": "4.6.0",
 "fixed_in": "5.3.4",
 "remediation": "Update to 5.3.4 or later.",
 "fix_released": "2026-10-14T10:01:06+00:00",
 "published": "2026-10-15T10:51:54+00:00",
 "updated": "2026-10-14T19:51:16.458326+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1004/",
  "https://plugins.svn.wordpress.org/download-monitor/tags/5.3.4/",
  "https://wordpress.org/plugins/download-monitor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/download-monitor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-15"
 }
}