Download Monitor EUVD-2026-102248

Exploitation requires an authenticated WordPress account with at least low-privilege posting capability (PR:L) able to submit data that Download Monitor stores and renders - the stored payload only fires when another user (UI:R), typically an administrator, subsequently views the affected admin or front-end page. Limiting factors: the attacker must already have a valid account on the target site, the malicious content must be reached/viewed by a victim, and the affected version must be at or below 5.3.3; there is no unauthenticated or zero-interaction path. These constraints make exploitation realistic only on sites that permit lower-trust user registration or multi-author workflows.

This is a moderate-severity Stored XSS (CWE-79) in the WP Chill Download Monitor WordPress plugin, scored CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires authenticated low-privilege access (PR:L) AND victim interaction (UI:R) - meaning an attacker needs an existing account (e.g., contributor/author) and must wait for another user to view the poisoned page. The scope-changed (S:C) flag reflects that injected script executes in a victim's browser context, potentially a higher-privileged admin. No EPSS score, KEV listing, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis'. There is no conflict between the CVSS vector and description - both are consistent with authenticated stored XSS. Net assessment: this is a real but not top-tier priority. The PR:L and UI:R requirements substantially limit mass exploitation, making it more suited to targeted privilege-escalation chains (e.g., a low-priv user escalating to admin via admin-viewed stored payload) than widespread automated attacks. Absence of EPSS/KEV/POC data should be treated as 'not provided' rather than confirmed-absent.

An attacker with a low-privilege authenticated WordPress account (such as contributor or author) submits a crafted download entry or field containing a malicious script payload that Download Monitor stores without proper sanitization. When an administrator or other user later views the affected page in wp-admin or on the front end, the stored JavaScript executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept was provided in the input.