CVE Database /
CVE-2015-9509
CVE · Medium
CVE-2015-9509 — Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2015-9509
|
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 2.3.7
|
2.3.7 |
2015-04-20 |
—
|
CVE-2015-9509
The Easy Digital Downloads plugin before version 2.3.7, across multiple release branches including 1.8.x, 1.9.x, 2.0.x, 2.1.x, 2.2.x, and 2.3.x, contains a cross-site scripting vulnerability in its Content Restriction extension. The flaw stems from improper use of the add_query_arg function, which fails to properly sanitize user input before outputting it in the page.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings