The Download Monitor WordPress plugin before version 5.3.4 fails to validate that a clicked link belongs to the same site before fetching it client‑side and rendering part of the response in the page. This flaw permits any unauthenticated user to trigger the plugin to load a response from an arbitrary external URL and inject arbitrary JavaScript into the victim’s browser. The result is a reflected XSS that can lead to cookie theft, session hijacking, defacement, or execution of malicious payloads in the context of the victim’s authenticated session. The weakness falls under CWE‑79.

The vulnerability applies to all WordPress installations running the Download Monitor plugin version 5.3.3 or earlier. Every site that has not patched to 5.3.4 or later is at risk.

The CVSS score and EPSS data are not available in the advisory, but the fact that unauthenticated attackers can inject and execute script in the browser of any user who clicks a crafted link indicates a severe confidentiality, integrity, and availability impact if the victim is a privileged user. The attack requires only social engineering to convince a user to click a malicious link, making it realistic and potentially damaging. Because the flaw is client‑side and relies on user interaction, it is not remotely exploitable without a browser visit, yet it remains a critical threat for WordPress sites exposed to untrusted users.