Technical impact
The Download Monitor WordPress plugin fails to verify that a clicked link belongs to the same site before fetching it client‑side and rendering part of the response in the page. This flaw allows an unauthenticated attacker to point the plugin at an arbitrary external URL and insert malicious JavaScript into the victim’s browser when the victim clicks a crafted link. The result is a reflected XSS that can be executed in the context of any user who follows the link.
Affected Systems
WordPress sites that have the Download Monitor plugin version 5.3.3 or earlier are affected. Updating to version 5.3.4 or newer removes the vulnerability.
Risk and Exploitability
The CVSS score is 7.1 and the EPSS score is < 1 %. The vulnerability requires no authentication, but an attacker must get a user to click a malicious link, which is a realistic social‑engineering scenario. The flaw is client‑side only; remote exploitation is not possible without the victim’s interaction, but any user who follows the crafted link is exposed to arbitrary JavaScript execution.
