Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS

2023-01-3000:00:00

Lana Codes

145

easy digital downloads

xss

contributor+

gutenberg block

css class

stored attack

security exploit

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Add the "EDD Buy Button" Gutenberg block to a post and put the payload below in the "Additional CSS class(es)" advanced block settings:

" onmouseover="alert(/XSS/)" style="background:red;"

Note: At least one Download need to exist for the issue to trigger.

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:3256E090-1131-459D-ADE5-F052CD5D189F