What is GHSA-q52q-7v6q-wrp3?

GHSA-q52q-7v6q-wrp3 is a security advisory published by GitHub Security Advisories with High severity. The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link...

Which CVE IDs does GHSA-q52q-7v6q-wrp3 cover?

GHSA-q52q-7v6q-wrp3 covers the following CVE IDs: CVE-2026-112207. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q52q-7v6q-wrp3?

GHSA-q52q-7v6q-wrp3 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-q52q-7v6q-wrp3HighCVSS 7.1

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link...

Vendor

GitHub Security Advisories

Published

October 24, 2026

Last Modified

October 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-112207 →

📋 Description

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-112207
https://wpscan.com/vulnerability/03d5e83b-3119-4862-b1be-8c6fe53f9963
https://github.com/advisories/GHSA-q52q-7v6q-wrp3