CVE-2012-4768

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for...

4.3 MediumPublic exploit

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.

Exploit likelihood

10.5%Up 8.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2012-4768
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-4768
Updated: 2026-11-02

EUVDEUVD-2012-4693 No score

Record: EUVD-2012-4693
Updated: 2026-11-03

GitHub AdvisoriesGHSA-77jp-2rxw-vqvq No score

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for...

Record: GHSA-77jp-2rxw-vqvq
Weakness: CWE-79
Updated: 2026-11-02

Affected products

mikejolley download monitor

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin Download Monitor - 'dlsearch' Cross-Site Scripting	2012-08-30
Nuclei	WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-4768 is a medium vulnerability (CVSS 4.3) in Mikejolley Download Monitor, published September 4, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.5%, the 95th percentile. No source names a fixed version.