Skip to content
Sign in
Not rated

CVE-2022-0706 The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the…

Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Affected products and versions

Product Affected versions Fixed in
Easy Digital Downloads – Simple eCommerce for Selling Digital Files 2.11 earliest → < 2.11.6 2.11.6

Other CVEs of Easy Digital Downloads – Simple eCommerce for Selling Digital Files

The 3 CVEs of Easy Digital Downloads – Simple eCommerce for Selling Digital Files →
CVE-2022-2387 The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment… 4.3 Medium CVE-2022-0707 The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment… Not rated
Track this CVE