CVE-2015-9527

The Easy Digital Downloads plugin for WordPress contained a cross-site scripting vulnerability in versions before 2.3.7 due to improper use of the add_query_arg function, which failed to properly sanitize user input in query parameters. This flaw affected multiple version branches including 1.8.x prior to 1.8.7, 1.9.x prior to 1.9.10, 2.0.x prior to 2.0.5, 2.1.x prior to 2.1.11, and 2.2.x prior to 2.2.9. An attacker could exploit this vulnerability to inject malicious scripts that would execute in the browsers of site administrators or users. The issue was resolved in version 2.3.7 and corresponding patch releases across earlier version branches.

Based on public CVE data (MITRE/NVD).