UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-112207
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-10-24T06:34:04.855449+00:00
- Cve id
- CVE-2026-112207
- First seen by Signal
- 2026-10-24T06:35:11+00:00
- Retrieved at
- 2026-10-24T06:35:11+00:00
- Published at
- 2026-10-24T06:16:36.143
- Last modified
- 2026-10-24T06:16:36.143
Explore deeper with Ninja Signal's threat intelligence graph