CVE-2026-2383 is a stored cross-site scripting vulnerability in the Simple Download Monitor plugin for WordPress, affecting all versions up to and including 4.0.5. The flaw allows authenticated users with Contributor-level permissions or above to inject arbitrary web scripts through a custom field due to improper input sanitization and output escaping. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector, low attack complexity, and requiring privileges with no user interaction.

An attacker with Contributor-level access or higher can inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to information disclosure or manipulation of user sessions. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Simple Download Monitor plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.