Awesomemotive Easy Digital Downloads vulnerabilities, page 2
57 vulnerabilities
Known vulnerabilities in Awesomemotive Easy Digital Downloads, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2015-9509awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9520awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9514awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9532awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9522awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9508awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9531awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9516awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9525awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9527awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9506awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9512awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9519awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2015-9521awesomemotive · easy_digital_downloads +2 moreawesomemotive easy_digital_downloadsThe Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.EPSS0.92%MediumCVE-2025-2252awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title DisclosureThe Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.EPSS0.39%MediumCVE-2025-4670awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt ShortcodeThe Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.34%HighCVE-2022-2439awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR DeserializationThe Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.EPSS0.69%HighCVE-2022-2387awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRFThe Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attackEPSS0.31%HighCVE-2022-0707awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRFThe Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attackEPSS0.48%MediumCVE-2022-0706awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site ScriptingThe Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowedEPSS0.66%