Easy Digital Downloads EUVD-2026-96116

The site must run Easy Digital Downloads (≤3.6.9) with the PayPal gateway enabled so that its IPN handler processes attacker-supplied IPN parameters; the attacker injects script into those parameters, which are stored without sanitization and rendered unescaped in the admin 'Gateway Error Logs' reporting table. Exploitation is remote and unauthenticated at the injection stage, but the payload only executes when a logged-in user - in practice a store administrator - views the gateway error logs page in wp-admin, which is the primary limiting factor on real-world impact. Stores not using the PayPal gateway are not exposed.

This is a moderate-priority, not a top-tier, issue. The CVSS 3.1 score of 7.2 is driven by the network vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and a changed scope (S:C) reflecting that an unauthenticated attacker's payload crosses a trust boundary to execute in a privileged admin browser context; however, impact is limited to C:L/I:L and A:N, consistent with a stored XSS rather than direct code execution. No EPSS probability, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or imminent mass exploitation - the quantitative exploitation signals are simply absent rather than conflicting. The PR:N rating is credible because PayPal IPN endpoints accept unauthenticated callbacks, but realistically the injected script only fires when a privileged user (e.g., an admin) opens the gateway error logs page, which tempers the practical blast radius despite the UI:N rating. Net: a legitimately network-reachable, unauthenticated stored XSS worth patching promptly, but absent KEV/EPSS/POC signals it should be prioritized below any flaw with confirmed exploitation.

An unauthenticated attacker sends a crafted PayPal IPN (Instant Payment Notification) request to a store running Easy Digital Downloads with the PayPal gateway, embedding a malicious script in IPN parameters that get stored unsanitized. When a site administrator later opens the gateway error logs in wp-admin, the stored script executes in their authenticated session, enabling session/account actions. No public exploit code was identified at time of analysis, and AV:N/AC:L means the delivery step is trivial once the PayPal gateway is in use.