CVE-2015-9520: XSS
The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-9520?
CVE-2015-9520 has been classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2015-9520?
To fix CVE-2015-9520, update Easy Digital Downloads to versions 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, or 2.3.7 or later.
What types of attacks can exploit CVE-2015-9520?
CVE-2015-9520 can be exploited for Cross-Site Scripting (XSS) attacks, allowing attackers to inject malicious scripts.
Which versions of Easy Digital Downloads are affected by CVE-2015-9520?
CVE-2015-9520 affects Easy Digital Downloads versions 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7.
Is the EDD Per Product Emails extension affected by CVE-2015-9520?
Yes, the EDD Per Product Emails extension is affected by CVE-2015-9520 due to its reliance on the vulnerable Easy Digital Downloads core.