CVE-2025-4670 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eddreceipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user...

CVE-2025-4670

CVE-2025-4670 affects the WordPress plugin “Easy Digital Downloads – eCommerce Payments and Subscriptions” up to version 3.3.8.1. The vulnerability is a Stored Cross-Site Scripting flaw in the edd_receipt shortcode caused by insufficient input sanitization and output escaping on user-supplied att...

WordPress plugin Easy Digital Downloads 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Easy Digital Downloads plugin, which stems from the application's lack of effective filtering and escaping of...

CVE-2025-4583: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-plugin attribute in all versions up to, and including, 6.9.0 Free and 6.8.0 Pro due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-4670: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eddreceipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user...

PT-2025-23143 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – eCommerce Payments and Subscriptions plugin for WordPress versions up to, and including, 3.3.8.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output...

WordPress Easy Digital Downloads plugin <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via eddreceipt Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Easy Digital Downloads versions = 3.3.8.1...

CVE-2025-40651

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-40651 Reflected Cross Site Scripting (XSS) in Real Easy Store

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-40651 Reflected Cross Site Scripting (XSS) in Real Easy Store

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-40651

Real Easy Store suffers a Reflected Cross-Site Scripting (XSS) via the keyword parameter in /index.php?a=search. An attacker can lure a victim to a crafted URL to execute JavaScript in the browser, potentially stealing session cookies or acting on behalf of the user. The CVSS data indicates a 5.1...

CVE-2025-40651: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

joudiSoft Real Easy Store 跨站脚本漏洞

joudiSoft Real Easy Store is a comprehensive e-commerce platform from joudiSoft that caters to the needs of every merchant. A cross-site scripting vulnerability exists in joudiSoft Real Easy Store, which stems from reflective cross-site scripting and could lead to an attacker executing JavaScript...

PT-2025-23084 · Unknown · Real Easy Store

Name of the Vulnerable Software and Affected Versions: Real Easy Store affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the keyword parameter in...

CVE-2025-46460

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through = 1.0.0...

CVE-2025-46460

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through = 1.0.0...

CVE-2025-46460

CVE-2025-46460 describes an SQL injection in WordPress plugin WordPress Easy Guide (versions n/a through 1.0.0) due to improper neutralization of input. Public sources (NVD/Patchstack/Red Hat/NVD entries in Connected docs) confirm the vulnerability and its high risk (CVSS v3.1 base score 9.3; net...

CVE-2025-46460 WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through = 1.0.0...

CVE-2025-46460 WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through = 1.0.0...

CVE-2025-23890

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tom Ewer Easy Tweet Embed easy-tweet-embed allows DOM-Based XSS.This issue affects Easy Tweet Embed: from n/a through = 1.7...