This vulnerability (CVE-2026-57427) is an unauthenticated Cross-Site Scripting (XSS) issue in Download Monitor - WPForms Lock plugin versions up to 1.0.4. It is caused by improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject malicious scripts into web pages viewed by other users. This can lead to partial disclosure of sensitive information, modification of data, and disruption of service availability. The vulnerability affects the confidentiality, integrity, and availability of the affected system to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access or applying temporary mitigations if possible.