CVE-2025-14121: EDD Download Info WordPress XSS Flaw

CVE-2025-14121 Overview

The EDD Download Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the edd_download_info_link shortcode in all versions up to and including 1.1. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the context of other users' sessions, potentially leading to session hijacking, credential theft, or malware distribution to site visitors.

Affected Products

• EDD Download Info WordPress Plugin version 1.1 and earlier
• WordPress sites using the vulnerable edd_download_info_link shortcode
• Easy Digital Downloads (EDD) ecosystem sites with this add-on installed

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-14121 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14121

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability resides in the shortcode processing functionality within the shortcodes.php file of the EDD Download Info plugin.

The core issue stems from the plugin's failure to properly sanitize and escape user-controlled input before rendering it in the HTML output. When a contributor or higher-privileged user crafts a malicious shortcode with specially crafted attributes, the unsanitized input is stored in the WordPress database and subsequently rendered to all users who view the affected page.

The attack requires network access and authenticated contributor-level privileges. While the confidentiality and integrity impacts are limited, the scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component—specifically, the browsers and sessions of users viewing the injected content.

Root Cause

The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the edd_download_info_link shortcode handler. The vulnerable code path at line 43 of shortcodes.php fails to apply WordPress's built-in escaping functions such as esc_attr(), esc_html(), or wp_kses() before outputting user-controlled data to the page.

Attack Vector

The attack is executed over the network by an authenticated user with at least contributor-level privileges. The attacker creates or edits a WordPress post or page, inserting a malicious edd_download_info_link shortcode containing JavaScript payloads within its attributes. Once published, any visitor to that page will have the malicious script execute in their browser context.

The stored nature of this XSS means the payload persists in the WordPress database, executing repeatedly without further attacker interaction. This makes it more dangerous than reflected XSS variants, as it can affect multiple users over an extended period.

For detailed technical analysis of the vulnerable code, see the WordPress EDD Shortcode File and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-14121

Indicators of Compromise

• Unusual shortcode patterns in WordPress posts containing edd_download_info_link with embedded script tags or event handlers
• Unexpected JavaScript execution or redirects when viewing pages with EDD Download Info shortcodes
• Presence of obfuscated or encoded JavaScript within shortcode attributes in the wp_posts database table
• Browser console errors or security warnings triggered on pages using the vulnerable plugin

Detection Strategies

• Audit WordPress content (posts, pages, custom post types) for suspicious edd_download_info_link shortcode usage containing HTML or JavaScript
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewalls (WAF) with XSS detection rules to identify malicious payloads in shortcode attributes
• Monitor browser-side security events for script injection patterns originating from shortcode-rendered content

Monitoring Recommendations

• Enable WordPress audit logging to track post edits by contributor-level and above users
• Implement real-time file integrity monitoring on plugin files, particularly shortcodes.php
• Configure security plugins to alert on potential XSS patterns in submitted content
• Review access logs for unusual patterns of page views that may indicate XSS exploitation

How to Mitigate CVE-2025-14121

Immediate Actions Required

• Update the EDD Download Info plugin to a patched version when available
• Review and audit all existing content using the edd_download_info_link shortcode for malicious payloads
• Temporarily disable the EDD Download Info plugin if a patch is not yet available
• Restrict contributor-level access to trusted users only until the vulnerability is patched

Patch Information

Currently, no patched version has been officially announced. Organizations using EDD Download Info version 1.1 or earlier should monitor the WordPress plugin repository and vendor communications for security updates. The vulnerable shortcode handling can be found in the trunk version of shortcodes.php.

SentinelOne Singularity XDR provides comprehensive protection against exploitation attempts by monitoring endpoint behavior and detecting malicious script execution patterns. Organizations using SentinelOne can leverage its real-time threat detection capabilities to identify and block XSS-based attacks targeting their WordPress infrastructure.

Workarounds

• Disable the EDD Download Info plugin entirely until a security patch is released
• Implement strict Content Security Policy headers to prevent inline script execution on WordPress pages
• Use a Web Application Firewall (WAF) with XSS filtering rules to sanitize malicious shortcode attributes
• Revoke contributor-level access from untrusted users to prevent exploitation

# Add Content Security Policy headers in .htaccess for Apache
# This helps mitigate XSS by blocking inline scripts
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"