CVE-2026-100182

Name of the Vulnerable Software and Affected Versions Download Monitor versions prior to 5.2.11

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via a Cross-Origin postMessage targeting the Admin Editor. An attacker can trick an authenticated Administrator into visiting a malicious page that targets an open Download edit screen. The payload is then persisted through the Administrator's unfiltered html capability and subsequently executed on the frontend via the unescaped post content render path of the [download data] shortcode.

Recommendations Update Download Monitor to version 5.2.11 or later.