CVE-2026-100182Published
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100182 · Microsoft / collected KEV context
cve-program · CVE-2026-100182
- https://www.wordfence.com/threat-intel/vulnerabilities/id/59d4c073-af86-4e60-87f5-94cc46f407a2?source=cve
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/assets/js/download-operations.js#L34
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/assets/js/download-operations.js#L11
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/src/Shortcodes.php#L285
- https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/src/Admin/AdminScripts.php#L56
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3716767%40download-monitor&new=3716767%40download-monitor
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.