The Simple Download Monitor WordPress plugin is vulnerable to stored cross‑site scripting via its custom field, allowing an authenticated user with Contributor or higher privileges to embed arbitrary JavaScript that executes in the browser of any visitor who views an affected page. This client‑side injection flaw (CWE‑79) can lead to cookie theft, session hijacking, defacement or the execution of further malicious payloads without the victim’s knowledge.

All WordPress sites that have installed Simple Download Monitor version 4.0.5 or earlier are affected. The vulnerability exists in every installation of the plugin within that version range, regardless of other plugins or theme configurations, and requires only that the authenticated user be able to create or edit download items.

The flaw carries a CVSS score of 6.4, placing it in the medium severity range, and an EPSS score below 1 %, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Attackers must be authenticated and hold at least Contributor access, making the vector an authentic one. Exploitation requires the creation or editing of a download item and the insertion of malicious JavaScript into its custom field, which is then stored and rendered whenever the page is accessed by any user.