The EDD Download Info plugin for WordPress is vulnerable to stored cross‑site scripting through the edd_download_info_link shortcode. Input supplied by authenticated users with contributor‑level access is not properly sanitized or escaped, allowing these users to embed malicious scripts that run whenever a page containing the injected content is viewed. This flaw can lead to compromise of confidential user data or execution of arbitrary code in the context of the website.

The vulnerability affects the EDD Download Info plugin by samikeijonen. All releases up to and including version 1.1 are impacted. No specific subcomponents are mentioned beyond the problematic shortcode attributes.

The CVSS score of 6.4 indicates a medium severity problem, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Because the attack requires authenticated access at the contributor level or higher, the exposure is limited to users granted those permissions. An attacker could create or modify download entries to inject scripts that execute whenever other site visitors view the affected page, leading to session hijacking, defacement, or credential theft.