CVE-2024-0659

MEDIUM

Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-0659 has a selected CVSS score of 5.5 (medium).

Description

The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 17, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Browse smub / Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Default status: unaffected

CVE ListThrough 3.2.6affected

References

3