7.2
High
CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored…
Description
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 3.6 | earliest → 3.6.9 | No fix stated |
References
- www.wordfence.com www.wordfence.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Timeline
- Published
- Last modified
Other CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
The 17 CVEs of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy →
CVE-2026-120538
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator…
8.1
High
CVE-2026-12476
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including…
7.2
High
CVE-2026-7533
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and…
4.3
Medium
CVE-2025-14783
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and…
4.3
Medium