CVE-2015-9513: XSS
Published Oct 23, 2019
·Updated
The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused.
Affected Software
14 affected components
Sandhillsdev Easy Digital Downloads Wordpress>=1.8<1.8.7
Sandhillsdev Easy Digital Downloads Wordpress>=1.9<1.9.10
Sandhillsdev Easy Digital Downloads Wordpress>=2.0<2.0.5
Sandhillsdev Easy Digital Downloads Wordpress>=2.1<2.1.11
Sandhillsdev Easy Digital Downloads Wordpress>=2.2<2.2.9
Sandhillsdev Easy Digital Downloads Wordpress>=2.3<2.3.7
Easydigitaldownloads Favorites Easy Digital Downloads
All of the following
Any of the following
Awesomemotive Easy Digital Downloads Wordpress>=1.8<1.8.7
Awesomemotive Easy Digital Downloads Wordpress>=1.9<1.9.10
Awesomemotive Easy Digital Downloads Wordpress>=2.0<2.0.5
Awesomemotive Easy Digital Downloads Wordpress>=2.1<2.1.11
Awesomemotive Easy Digital Downloads Wordpress>=2.2<2.2.9
Awesomemotive Easy Digital Downloads Wordpress>=2.3<2.3.7
Easydigitaldownloads Favorites Easy Digital Downloads
Event History
Oct 23, 2019
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
Description
Frequently Asked Questions
1
What is CVE-2015-9513?
CVE-2015-9513 is a vulnerability in the Easy Digital Downloads (EDD) Favorites extension for WordPress.
2
How does CVE-2015-9513 affect Easy Digital Downloads?
CVE-2015-9513 affects Easy Digital Downloads versions 1.8.x through 2.3.x.
3
What is the severity of CVE-2015-9513?
CVE-2015-9513 has a severity rating of 6.1 (medium).
4
How is CVE-2015-9513 exploited?
CVE-2015-9513 is exploited through a cross-site scripting (XSS) vulnerability caused by the misuse of add_query_arg function in Easy Digital Downloads Favorites extension.
5
How can I fix CVE-2015-9513?
To fix CVE-2015-9513, update Easy Digital Downloads Favorites extension to version 2.3.7 or higher.