Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting
CVE-2022-0706

4.8MEDIUM

Key Information:

Vendor

Wordpress
Status
Easy Digital Downloads – Simple Ecommerce For Selling Digital Files
Vendor
CVE Published:
18 April 2022

What is CVE-2022-0706?

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Affected Version(s)

Easy Digital Downloads – Simple eCommerce for Selling Digital Files 2.11.6

References

https://wpscan.com/vulnerability/598d5c1b-7930-46a6-9a31-...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2697388
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhamad hidayat
.