CVE-2026-100182 in Download Monitor Plugin
Summary
by MITRE • 10/02/2026
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode's unescaped post_content render path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the WordPress plugin Download Monitor affects all versions up to and including 5.2.10, representing a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms. This specific weakness allows for Stored Cross-Site Scripting attacks that exploit the interaction between cross-origin postMessage events and the administrative editor interface. The core technical failure lies in how the plugin handles data passed through these messaging channels without adequate validation or encoding, creating a pathway for malicious actors to inject arbitrary web scripts into pages within the WordPress environment.
The operational impact of this vulnerability is severe because it enables unauthenticated attackers to persistently store malicious code on the server side. The attack vector requires social engineering elements where an attacker must trick an authenticated Administrator with specific privileges into visiting a page controlled by the attacker. This target page is designed to send a crafted postMessage event that targets an open Download edit screen within the WordPress admin interface. Once this interaction occurs, the malicious payload bypasses existing security controls and is persisted unfiltered due to the administrator's unfiltered_html capability, which grants elevated permissions for HTML content handling without strict sanitization checks.
Following persistence, the stored script remains dormant until it is triggered by legitimate user activity. The vulnerability manifests when the [download_data] shortcode processes post_content data on the frontend of the website. Because this render path emits the stored content verbatim without proper escaping, any injected JavaScript executes in the context of users viewing these pages. This execution environment allows attackers to perform actions such as stealing session cookies, hijacking administrative sessions, defacing websites, or redirecting users to malicious sites, thereby compromising the integrity and confidentiality of the entire WordPress installation.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The persistence mechanism leverages CWE-830 regarding Inclusion of Functionality from Untrusted Control Source, while the exploitation technique involving postMessage corresponds to ATT&CK T1562.007 under Impair Defenses via Disable or Modify Tools, specifically targeting browser security features through cross-origin messaging abuse. The reliance on administrative privileges for persistence highlights CWE-862 regarding Missing Authorization checks in specific contexts where expected restrictions are bypassed due to configuration weaknesses rather than code logic errors alone.
Mitigation strategies must focus on immediate remediation and long-term hardening practices. Administrators should update the Download Monitor plugin to a version newer than 5.2.10 as soon as possible, ensuring that developers have addressed the input sanitization and output escaping deficiencies in their latest release. In environments where updating is not immediately feasible, implementing strict Content Security Policy headers can help mitigate the impact of any executed scripts by restricting source domains for script execution. Additionally, reviewing user capabilities to ensure that only necessary users possess the unfiltered_html capability reduces the attack surface available to persistent storage attacks. Regular security audits and code reviews focusing on cross-origin messaging handlers are essential to prevent similar vulnerabilities in future development cycles.