CVE-2026-100182 is a stored cross-site scripting vulnerability in the Download Monitor WordPress plugin (versions <=5.2.10). It arises from insufficient input sanitization and output escaping in handling cross-origin postMessage data to the admin editor. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious page, causing the injection of arbitrary scripts that persist in the plugin's content. These scripts execute later when the content is displayed on the frontend through the [download_data] shortcode, leveraging the administrator's unfiltered_html capability to bypass filtering.

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts that execute in the context of authenticated users, including administrators. This can lead to partial confidentiality and integrity loss (e.g., theft of sensitive data or manipulation of content) but does not affect availability. The vulnerability requires social engineering to lure an administrator to a malicious page.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid exposing the Download Monitor edit screens to untrusted environments and limit administrator exposure to untrusted links. Consider disabling the plugin or restricting its use if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.