CVE-2015-9530 Easy Digital Downloads – Upload File <= 1.0.4 - Arbitrary File Upload/Deletion
MediumCVSS 6.1
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress edd-upload-file(WordPress) | < 1.0.4 | 1.0.4 |
| Awesomemotive Easy Digital Downloads | >= 1.8, < 1.8.7 | 1.8.7 |
| Awesomemotive Easy Digital Downloads | >= 1.9, < 1.9.10 | 1.9.10 |
| Awesomemotive Easy Digital Downloads | >= 2.0, < 2.0.5 | 2.0.5 |
| Awesomemotive Easy Digital Downloads | >= 2.1, < 2.1.11 | 2.1.11 |
| Awesomemotive Easy Digital Downloads | >= 2.2, < 2.2.9 | 2.2.9 |
| Awesomemotive Easy Digital Downloads | >= 2.3, < 2.3.7 | 2.3.7 |
| easydigitaldownloads upload file | All versions | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- web.archive.org vendor-advisory