{"id":"CVE-2015-9505","aliases":["EUVD-2015-9345","GHSA-3xp6-pxgj-3wj7"],"status":"published","title":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x...","description":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00923,"percentile":0.60604,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2019-10-23T16:13:41Z","modified":"2026-06-17T00:36:39Z","products":[{"vendor":"awesomemotive","product":"easy_digital_downloads"}],"references":[{"url":"https://web.archive.org/web/20160921003517/https://easydigitaldownloads.com/blog/security-fix-released/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-9505"},{"url":"https://web.archive.org/web/20160921003517/https://easydigitaldownloads.com/blog/security-fix-released"},{"url":"https://github.com/advisories/GHSA-3xp6-pxgj-3wj7"}],"sources":{"cve":[{"id":"CVE-2015-9505","description":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.","status":"published","published":"2019-10-23T16:13:41Z","modified":"2024-08-06T08:51:05.384Z","updated_at":"2026-11-02T14:35:40.591596Z"}],"euvd":[{"id":"EUVD-2015-9345","description":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.","status":"published","published":"2019-10-23T16:13:41Z","modified":"2024-08-06T08:51:05Z","updated_at":"2026-11-03T01:57:23.860633Z"}],"ghsa":[{"id":"GHSA-3xp6-pxgj-3wj7","title":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x...","description":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.","status":"published","published":"2022-05-24T16:59:39Z","modified":"2024-04-04T02:33:01Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:08.751002Z"}],"nvd":[{"id":"CVE-2015-9505","description":"The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.","status":"published","published":"2019-10-23T17:15:10.91Z","modified":"2026-06-17T00:36:39.83Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:19.73542Z"}]}}