7.1Hoch

CVE-2026-112207Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

Download Monitor Veröffentlicht: 2026-10-24 09:00 (vor 12 Tagen)

Beschreibung

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
—	Download Monitor	< 5.3.4

Referenzen und Patches

https://wpscan.com/vulnerability/03d5e83b-3119-4862-b1be-8c6fe53f9963/ exploitvdb-entrytechnical-description

CVSS-Score

7.1Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Niedrig

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Alle Scores (2)

CISA-ADP	CVSS 3.1	7.1Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.1Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.21%

höher als 12 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-10-19
Veröffentlicht2026-10-24 09:00
Bei IP-DB eingegangen2026-10-24 23:25
Zuletzt aktualisiert2026-10-26 16:50

Vergeben von (CNA): WPScan
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

2.2Niedrig

CVE-2026-107776 vor 5 Stunden

Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon

Dokan

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less …

9.8Kritisch

CVE-2026-100109 vor 5 Stunden

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

Security For WooCommerce

The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…

Ohne Score

CVE-2026-109150 vor 7 Stunden

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

WP PageNavi Style

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is…

Ohne Score

CVE-2026-107787 vor 7 Stunden

CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge

CatFolders

The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin…

Ohne Score

CVE-2026-107786 vor 7 Stunden

CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting

CatFolders

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.

Ohne Score

CVE-2026-107775 vor 7 Stunden

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsit…