An attacker can store and inject malicious JavaScript into the WordPress Download Monitor plugin’s output. When the page renders, the script executes in the victim's browser, enabling session hijacking, credential theft, or other malicious actions. The flaw is an instance of improper input neutralization during page generation, classified as CWE‑79.

The issue affects the WP Chill Download Monitor plugin up to and including version 5.3.3. Any WordPress installation using these or older versions is vulnerable; versions 5.3.4 and later contain the fix.

The CVSS score of 6.5 marks it as high‑severity. The EPSS indicates a very low exploitation probability (< 1 %), and it is not listed in the CISA KEV catalog. Nevertheless, because the flaw is stored XSS, any authenticated administrator or unauthenticated user who can manipulate download entries may inject code, leading to compromise of all visitors to those pages. An attacker does not need system privileges, and the attack vector is via the plugin’s input handling of download metadata.