Download Monitor CVE-2026-112207

Exploitation requires that a user be tricked into clicking an attacker-crafted link that is processed by Download Monitor's client-side link-fetching behavior (versions before 5.3.4), which does not validate that the clicked link belongs to the site before fetching it and rendering part of the response in the page. No authentication is required (PR:N), but exploitation is limited by the mandatory user interaction (UI:R) - the victim must actively click the malicious link - and by whether the victim visits a site running an affected version; there is no indication of a non-default configuration requirement. Updating to 5.3.4 is the vendor-provided fix.

Signals are coherent and point to a moderate, interaction-gated risk rather than an emergency. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated flaw whose exploitation nevertheless hinges on UI:R - a victim must be tricked into clicking a crafted link - so it is not a wormable or drive-by condition. EPSS is low at 0.24% (14th percentile), which aligns with a client-side XSS that needs social engineering and is not trivially mass-exploited. It is NOT in CISA KEV (no confirmation of active exploitation), and the exploit reference is a WPScan advisory entry that is not verified as working exploit code, so active exploitation and weaponization are unconfirmed. The vuln.today decision label is 'this_week', consistent with a patched, unauthenticated XSS in a popular plugin that warrants prompt but not emergency remediation. No contradictions between signals were found; the main limiter is the required user interaction, which keeps real-world risk below what the 7.1 score alone might suggest.

An attacker crafts a malicious download/link URL and lures a site visitor or logged-in user into clicking it (e.g., via phishing, a forum post, or a comment). Because the plugin fetches the linked resource client-side without validating that it belongs to the site and renders part of the response, attacker-controlled JavaScript executes in the victim's browser in the site's context. A public PoC reference exists (WPScan advisory); it is not verified as working exploit code.