Awesomemotive Easy Digital Downloads vulnerabilities, page 3

57 vulnerabilities

Known vulnerabilities in Awesomemotive Easy Digital Downloads, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CriticalCVE-2022-3600awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads < 3.1.0.2 - Unauthenticated CSV InjectionThe Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.EPSS1.31%9.8CriticalCVE-2022-33900awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerabilityPHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.EPSS0.92%5.3MediumCVE-2024-2302awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information ExposureThe Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.EPSS0.60%4.4MediumCVE-2024-13517awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via TitleThe Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.EPSS0.24%5.5MediumCVE-2024-0659awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing optionsThe Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.40%3.7LowCVE-2024-9654awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall BypassThe Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.EPSS0.36%8.8HighCVE-2024-43162awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads plugin <= 3.2.12 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.EPSS0.49%10CriticalCVE-2024-5057awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.EPSS2.59%4.4MediumCVE-2024-6691awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency SettingsThe Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.EPSS0.35%3.3LowCVE-2024-6692awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement TextThe Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.EPSS0.38%4.9MediumCVE-2024-12875awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File DownloadThe Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.EPSS0.99%6.1MediumCVE-2019-15116awesomemotive · easy_digital_downloads +1 moreawesomemotive easy_digital_downloadsThe easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.EPSS0.97%7.5HighCVE-2026-42638awesomemotive · easy_digital_downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.EPSS0.26%7.5HighCVE-2026-39503awesomemotive · easy_digital_downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.EPSS0.35%9.8CriticalCVE-2023-40005awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access ControlMissing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.EPSS0.64%6.5MediumCVE-2023-51684awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.EPSS0.33%9.8CriticalCVE-2023-30869awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege EscalationImproper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.EPSS3.10%