CVE-2015-9533: XSS

Q: What is CVE-2015-9533?

CVE-2015-9533 is a vulnerability in the Easy Digital Downloads (EDD) Lattice theme for WordPress.

Q: What is the severity of CVE-2015-9533?

The severity of CVE-2015-9533 is medium.

Q: How does CVE-2015-9533 affect the Easy Digital Downloads (EDD) Lattice theme?

CVE-2015-9533 allows for cross-site scripting (XSS) attacks due to the misuse of the add_query_arg function.

Q: Which versions of Easy Digital Downloads (EDD) Lattice are affected?

Easy Digital Downloads (EDD) Lattice versions 1.8.x to 1.8.7, 1.9.x to 1.9.10, 2.0.x to 2.0.5, 2.1.x to 2.1.11, 2.2.x to 2.2.9, and 2.3.x to 2.3.7 are affected.

Q: How can I fix CVE-2015-9533?

To fix CVE-2015-9533, update to Easy Digital Downloads (EDD) Lattice version 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, or 2.3.7.

Published Oct 23, 2019

Updated

The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused.

Affected Software

14 affected components

All of the following

Any of the following

Awesomemotive Easy Digital Downloads Wordpress>=1.8<1.8.7

Awesomemotive Easy Digital Downloads Wordpress>=1.9<1.9.10

Awesomemotive Easy Digital Downloads Wordpress>=2.0<2.0.5

Awesomemotive Easy Digital Downloads Wordpress>=2.1<2.1.11

Awesomemotive Easy Digital Downloads Wordpress>=2.2<2.2.9

Awesomemotive Easy Digital Downloads Wordpress>=2.3<2.3.7

Easydigitaldownloads Lattice Easy Digital Downloads

Sandhillsdev Easy Digital Downloads Wordpress>=1.8<1.8.7

Sandhillsdev Easy Digital Downloads Wordpress>=1.9<1.9.10

Sandhillsdev Easy Digital Downloads Wordpress>=2.0<2.0.5

Sandhillsdev Easy Digital Downloads Wordpress>=2.1<2.1.11

Sandhillsdev Easy Digital Downloads Wordpress>=2.2<2.2.9

Sandhillsdev Easy Digital Downloads Wordpress>=2.3<2.3.7

Easydigitaldownloads Lattice Easy Digital Downloads

Event History

Oct 23, 2019

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

Description

Frequently Asked Questions

What is CVE-2015-9533?

CVE-2015-9533 is a vulnerability in the Easy Digital Downloads (EDD) Lattice theme for WordPress.

What is the severity of CVE-2015-9533?

The severity of CVE-2015-9533 is medium.

How does CVE-2015-9533 affect the Easy Digital Downloads (EDD) Lattice theme?

CVE-2015-9533 allows for cross-site scripting (XSS) attacks due to the misuse of the add_query_arg function.

Which versions of Easy Digital Downloads (EDD) Lattice are affected?

Easy Digital Downloads (EDD) Lattice versions 1.8.x to 1.8.7, 1.9.x to 1.9.10, 2.0.x to 2.0.5, 2.1.x to 2.1.11, 2.2.x to 2.2.9, and 2.3.x to 2.3.7 are affected.

How can I fix CVE-2015-9533?