easy_digital_downloads Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/easy_digital_downloads/ Sun, 26 Feb 2023 06:30:49 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png easy_digital_downloads Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/easy_digital_downloads/ 32 32 CVE-2019-15116 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-15116/ Sun, 26 Feb 2023 06:30:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-15116/ The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.

The post CVE-2019-15116 appeared first on CVE Vulnerability.

]]> The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.

The post CVE-2019-15116 appeared first on CVE Vulnerability.

]]> CVE-2021-39354 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-39354/ Thu, 23 Feb 2023 14:11:29 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-39354/ The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.

The post CVE-2021-39354 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.

The post CVE-2021-39354 appeared first on CVE Vulnerability.

]]> CVE-2022-3600 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-3600/ Thu, 23 Feb 2023 05:19:46 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-3600/ The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.

The post CVE-2022-3600 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.

The post CVE-2022-3600 appeared first on CVE Vulnerability.

]]> CVE-2022-33900 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-33900/ Thu, 23 Feb 2023 05:19:18 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-33900/ PHP Object Injection vulnerability in Easy Digital Downloads plugin

The post CVE-2022-33900 appeared first on CVE Vulnerability.

]]> PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

The post CVE-2022-33900 appeared first on CVE Vulnerability.

]]> CVE-2022-2387 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-2387/ Thu, 23 Feb 2023 05:03:08 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-2387/ The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

The post CVE-2022-2387 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

The post CVE-2022-2387 appeared first on CVE Vulnerability.

]]> CVE-2022-0706 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-0706/ Thu, 23 Feb 2023 05:01:56 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-0706/ The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

The post CVE-2022-0706 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

The post CVE-2022-0706 appeared first on CVE Vulnerability.

]]> CVE-2022-0707 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-0707/ Thu, 23 Feb 2023 05:01:56 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-0707/ The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

The post CVE-2022-0707 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

The post CVE-2022-0707 appeared first on CVE Vulnerability.

]]> CVE-2023-23489 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-23489/ Wed, 22 Feb 2023 14:02:25 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-23489 The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the ‘s’ parameter of its ‘edd_download_search’ action.

The post CVE-2023-23489 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the ‘s’ parameter of its ‘edd_download_search’ action.

The post CVE-2023-23489 appeared first on CVE Vulnerability.

]]> CVE-2023-0380 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0380/ Wed, 22 Feb 2023 14:02:14 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0380 The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0380 appeared first on CVE Vulnerability.

]]> The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0380 appeared first on CVE Vulnerability.

]]>