What is the CVSS score of CVE-2026-57427?

CVE-2026-57427 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Download Monitor are affected by CVE-2026-57427?

WordPress installations using Download Monitor - WPForms Lock add-on (versions 1.0.4 or earlier) contain an unauthenticated cross-site scripting vulnerability that allows attackers to inject…

How to fix or mitigate CVE-2026-57427?

Within 24 hours: Identify all WordPress deployments using Download Monitor - WPForms Lock ≤1.0.4 and immediately deactivate the plugin. Within 7 days: Contact the plugin vendor to confirm patch availability; if released, stage and test the update before production deployment. By day 30: Deploy patched versions when available, or permanently disable the plugin and migrate to alternative solutions; establish weekly vendor security monitoring.

Download Monitor CVE-2026-57427

EUVD-2026-48169 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-vrhh-vwx7-mfvg

WordPress XSS Download Monitor Wordpress Plugin Download Monitor Wpforms Lock

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable unauthenticated reflected XSS requiring victim interaction (UI:R) with browser-scope change (S:C) and session-level confidentiality/integrity impact; availability impact does not realistically apply, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:19 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

AnalysisAI

Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.

Technical ContextAI

The affected component is WPForms Lock, an add-on to the Download Monitor WordPress plugin (CPE cpe:2.3:a:download_monitor:download_monitor_-_wpforms_lock) that gates file downloads behind WPForms submissions. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controllable input is reflected into an HTML response without proper output encoding or sanitization, so a browser interprets attacker-supplied markup/JavaScript as page content. Because WordPress plugins render within the site's trusted origin, injected script executes with the privileges of whatever user is viewing the page, and the CVSS scope change indicates impact crosses from the vulnerable component into the browser/session context.

RemediationAI

Upgrade the Download Monitor - WPForms Lock add-on to a version later than 1.0.4 once released; the supplied data confirms 1.0.4 and earlier are vulnerable but does not include a specific fixed version, so this is best described as a released patched version not independently confirmed - verify the current version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dlm-wpforms-lock/vulnerability/wordpress-download-monitor-wpforms-lock-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org / vendor changelog. Until a fixed release is applied, compensating controls include deploying a WordPress-aware WAF or Patchstack's virtual patching to filter XSS payloads on the plugin's request parameters (trade-off: rule tuning and possible false positives), restricting or disabling the WPForms Lock download-gating feature if it is not essential (trade-off: loss of form-gated download functionality), and adding a strict Content-Security-Policy that disallows inline script to blunt reflected-XSS execution (trade-off: may break inline scripts used by the theme/other plugins and requires testing).