CVE Database /
CVE-2021-39354
CVE · Medium
CVE-2021-39354 — Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.2.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-39354
|
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.2.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 2.11.2.1
|
2.11.2.1 |
2021-10-21 |
—
|
CVE-2021-39354
The Easy Digital Downloads plugin before version 2.11.2.1 contains a reflected cross-site scripting vulnerability in its payments table functionality. Attackers can inject malicious scripts through the start_date and end_date parameters in the payments table class file. This flaw allows unauthorized execution of arbitrary JavaScript code in the context of an administrator's browser session. The vulnerability affects all versions up to and including 2.11.2.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings