CVE-2012-4768: Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the de

medium Affects download-monitor (WordPress plugin). Feed 2026.10.29.3, updated 2026-10-29; published 2014-09-04; advisory modified 2026-06-16.

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the de

Package: download-monitor (WordPress plugin) WordPress
Affected versions: =3.3.5.7
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 10% (95.7th percentile)
Published: 2014-09-04
Source: nvd

References

CWE-79

NVD record download-monitor (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-23174 low Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in D same package: download-monitor (WordPress plugin)
CVE-2021-24786 high The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape t same package: download-monitor (WordPress plugin)
CVE-2013-3262 medium Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin same package: download-monitor (WordPress plugin)
CVE-2013-5098 medium Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin same package: download-monitor (WordPress plugin)
CVE-2021-31567 medium Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monito same package: download-monitor (WordPress plugin)
CVE-2022-2222 medium The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downl same package: download-monitor (WordPress plugin)