Stored Cross-Site Scripting Vulnerability in Easy Digital Downloads Plugin

The Easy Digital Downloads plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within its handling of PayPal Instant Payment Notification (IPN) parameters. This vulnerability affects all versions up to and including 3.6.9. An unauthenticated attacker can exploit this flaw by sending crafted requests containing malicious JavaScript to the plugin's IPN processing endpoint. When these payloads are successfully stored and later rendered in the browser of an administrator or other authenticated user, the script executes, potentially leading to session hijacking, unauthorized actions, or further compromise of the WordPress site. This vulnerability highlights the importance of rigorous input validation for third-party payment integration endpoints.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' sessions. This can lead to the compromise of administrator accounts, unauthorized modification of site content, or the injection of malicious redirects. Given the widespread use of Easy Digital Downloads for e-commerce, this vulnerability poses a significant risk to the integrity and security of online storefronts.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Patch the Easy Digital Downloads plugin to the latest available version beyond 3.6.9 immediately.
• Audit WordPress access logs for anomalous HTTP POST requests directed at payment notification endpoints that include script tags or common XSS payloads in query parameters.
• Implement or enforce a strong Content Security Policy (CSP) to mitigate the impact of XSS by restricting the execution of unauthorized scripts.
• Review administrative logs for unusual account modifications or unauthorized actions that may indicate successful session compromise via XSS.