Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Easy Digital Downloads – Simple eCommerce for Selling Digital Files 2.11.6 Clear all filters
TI-2022-00621 CVE-2022-0707 · GHSA-r26r-2j23-r3hv

Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF

Priority LOW 21

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00477 Published 2022-04-18 Fixed in 2.11.6 CWE-352
TI-2022-00620 CVE-2022-0706 · GHSA-2m3m-g8h2-cx6m

Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00661 Published 2022-04-18 Fixed in 2.11.6 CWE-79