5.4
Moyenne
CVE-2023-0380 The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before…
Description
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Easy Digital Downloads 3.1 | premières → < 3.1.0.5 | 3.1.0.5 |
Autres CVE de Easy Digital Downloads
Les 4 CVE de Easy Digital Downloads →
CVE-2026-105190
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before…
5.3
Moyenne
CVE-2026-105194
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user,…
4.3
Moyenne
CVE-2022-3600
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which…
9.8
Critique