Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2021-39354)
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
PLUGIN
Easy Digital Downloads
CVE-2021-39354
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9524)
The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9524
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9523)
The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9523
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9522)
The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9522
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9521)
The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9521
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9520)
The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9520
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9519)
The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9519
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9518)
The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9518
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9517)
The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9517
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9516)
The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9516
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9515)
The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9515
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9514)
The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9514
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9513)
The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9513
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9512)
The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9512
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9511)
The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9511
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9510)
The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9510
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9509)
The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9509
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9508)
The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9508
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9507)
The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9507
Risk Score
Threat Entry
Updated 2026-06-17
Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2015-9506)
The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
PLUGIN
Easy Digital Downloads
CVE-2015-9506
Risk Score