Cross-Site Scripting Vulnerability in Easy Digital Downloads QR Code Extension by WordPress
CVE-2015-9522

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Easy Digital Downloads
Qr Code
Vendor
CVE Published:
23 October 2019

What is CVE-2015-9522?

The Easy Digital Downloads (EDD) QR Code extension for WordPress is prone to a Cross-Site Scripting (XSS) vulnerability due to improper usage of the add_query_arg function. This security flaw affects specific versions of EDD, allowing malicious users to inject arbitrary scripts. This can lead to unauthorized actions performed on behalf of an authenticated user, posing a significant risk to the integrity of web applications using this extension. Users are advised to update to the latest versions to mitigate potential attacks.

References

https://web.archive.org/web/20160921003517/https://easydi...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.