Unrated severityNVD Advisory· Published Apr 18, 2022· Updated Aug 2, 2024

Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting

CVE-2022-0706

Description

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Easy Digital Downloadscpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.11.6
Package: https://wordpress.org/plugins/easy-digital-downloads

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/2697388mitrex_refsource_CONFIRM
wpscan.com/vulnerability/598d5c1b-7930-46a6-9a31-5e08a5f14907mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000