5.4
Medium
CVE-2023-0380 The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before…
Description
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Digital Downloads 3.1 | earliest → < 3.1.0.5 | 3.1.0.5 |
Other CVEs of Easy Digital Downloads
The 4 CVEs of Easy Digital Downloads →
CVE-2026-105190
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before…
5.3
Medium
CVE-2026-105194
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user,…
4.3
Medium
CVE-2022-3600
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which…
9.8
Critical