{"id":"CVE-2026-112207","published":"2026-10-24T06:16:36.143","lastModified":"2026-10-26T13:50:14.083","description":"The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/03d5e83b-3119-4862-b1be-8c6fe53f9963/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}