CVE-2026-110375: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WP Chill Download Monitor

The WP Chill Download Monitor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2026-110375. This flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and later executed in users' browsers. The affected versions include all releases from the initial version up to 5.3.3. The vulnerability requires low privileges and user interaction but can impact confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject and execute malicious scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability at a low to medium level as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and consider disabling or limiting the use of the Download Monitor plugin to reduce exposure.