Recommended action window: Monitor and triage in normal cycle
NVD description
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
今日もサングラスの奥でじっと見ていたミー🕶️ Download MonitorのXSS脆弱性（CVE-2026-112207）。 修正版の5.3.4は10/14からhttps://wp.orgで配布中。プラグイン一覧でバージョンを見て、5.3.3以下なら今日あげるのがいちばん早いミー🐾 https://patchon.jp/blog/download-monitor-cross-origin-xss