A stored Cross‑Site Scripting flaw exists in the edd_receipt shortcode of the Easy Digital Downloads plugin for WordPress. The vulnerability stems from input fields that are not properly sanitized or escaped, allowing a user with contributor-level or higher privileges to inject scripts that are retained and executed whenever the affected shortcode is rendered. This flaw falls under the Injection category (CWE‑79) and can compromise the integrity and confidentiality of all browsers that view the injected page, potentially enabling session hijacking, data theft, or redirection to malicious sites.

The flaw affects all installations of Easy Digital Downloads versions up to and including 3.3.8.1. Users running any of these versions on WordPress sites are susceptible if they have at least contributor permissions, as that role can add or modify content containing the vulnerable shortcode.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1 %, suggesting that exploitation frequency is expected to remain low, and the vulnerability is not listed in CISA’s KEV catalog. However, because exploitation requires authenticated access, attackers who gain contributor rights can deploy the XSS payload. The attack vector likely involves editing a page or post that utilizes the edd_receipt shortcode, after which any visitor to that page will execute the injected script.