Vulnerabilities

TI-2024-21177 CVE-2024-32100 · GHSA-5jhx-vpph-fr8r

WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2024-05-13 No fix listed CWE-200

TI-2024-20502 CVE-2024-31113 · GHSA-fvh8-9h4h-hc67

WordPress Easy Digital Downloads plugin <= 3.2.11 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0022 Published 2024-05-10 No fix listed CWE-352

TI-2024-20669 CVE-2024-31293 · GHSA-9r64-chx7-hchc

WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00227 Published 2024-04-12 No fix listed CWE-352

TI-2023-00364 CVE-2023-0380 · GHSA-gx84-73xf-rvpg

Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS

MEDIUM 58

The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the cont…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00457 Published 2023-02-21 Fixed in 3.1.0.5

TI-2023-09324 CVE-2023-23489 · GHSA-7745-326p-vhm6

SQL injection in Easy Digital Downloads WordPress Plugin

HIGH 82

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11286 Published 2023-01-20 Fixed in 3.1.0.4 CWE-89