CVE-2021-39354 Easy Digital Downloads <= 2.11.2 Authenticated Reflected Cross-Site Scripting

What is CVE-2021-39354?

CVE-2021-39354 is a medium-severity cross-site scripting vulnerability in Awesomemotive Easy Digital Downloads, published on 21 Oct 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.

Weakness: CWE-79

Which versions are affected by CVE-2021-39354?

It affects 1 product.

Products include Awesomemotive Easy Digital Downloads.

How do I fix CVE-2021-39354?

No fix has been published for CVE-2021-39354 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-39354 being exploited?

There is no known exploitation of CVE-2021-39354 in the wild and no public exploit code.

Other vulnerabilities in Awesomemotive Easy Digital Downloads

• CVE-2023-30869 WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation Critical 9.8
• CVE-2022-3600 Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection Critical 9.8
• CVE-2015-9324 SQL injection in n/a Critical 9.8
• CVE-2024-5057 WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability Critical 9.3
• CVE-2022-2439 Deserialization in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy High 7.2

All Awesomemotive Easy Digital Downloads vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made