CVE-2025-14121: EDD Download Info WordPress XSS Flaw

CVE-2025-14121 Overview

CVE-2025-14121 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the EDD Download Info plugin for WordPress through version 1.1. The flaw resides in the edd_download_info_link shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level attackers can persist malicious JavaScript on published pages, enabling session theft, credential harvesting, and administrator account compromise through cross-site scripting payloads.

Affected Products

EDD Download Info plugin for WordPress — all versions through 1.1
WordPress sites running Easy Digital Downloads with this extension installed
Sites permitting contributor or higher user registration

Discovery Timeline

2026-01-07 - CVE-2025-14121 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14121

Vulnerability Analysis

The EDD Download Info plugin registers a shortcode named edd_download_info_link defined in includes/shortcodes.php. The shortcode accepts user-supplied attributes that are rendered into HTML output without sufficient sanitization or escaping. Because shortcode attributes pass through to the rendered page, any markup or script payload embedded in those attributes is delivered verbatim to site visitors.

WordPress contributor accounts can author posts containing shortcodes. The plugin's failure to wrap attribute values in escaping functions such as esc_attr() or esc_html() allows contributor accounts to embed <script> elements or event handlers. Although contributor posts require editor approval to publish, the malicious markup persists through the editorial workflow because it appears as a benign shortcode in the post editor.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode handler at line 43 of includes/shortcodes.php. Attribute values flow directly into the generated HTML link without passing through WordPress escaping APIs. WordPress documentation explicitly recommends esc_attr() for HTML attribute contexts and esc_url() for URL contexts, neither of which the vulnerable handler applies.

Attack Vector

An attacker authenticates with a contributor or higher role and creates a post containing the edd_download_info_link shortcode with a malicious attribute payload. After the post is reviewed and published, every visitor loading the page executes the injected script in the context of the site origin. The Scope:Changed CVSS metric reflects that the script runs with the privileges of the viewing user, including administrators.

Review the vulnerable handler in the WordPress EDD Shortcode File and the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-14121

Indicators of Compromise

Posts or pages containing edd_download_info_link shortcodes with attribute values that include HTML tags, JavaScript event handlers (e.g., onerror=, onclick=), or javascript: URI schemes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains following page renders.
New or modified WordPress administrator accounts created shortly after contributor activity on pages using the plugin.

Detection Strategies

Query the wp_posts table for entries containing the string edd_download_info_link and inspect attribute values for script payloads or HTML metacharacters.
Inspect rendered page HTML for inline <script> tags or event handlers originating from plugin output blocks.
Review WordPress audit logs for contributor-role users submitting posts that reference the vulnerable shortcode.

Monitoring Recommendations

Enable a web application firewall with XSS signature rules covering WordPress shortcode contexts.
Monitor Content Security Policy violation reports for inline script execution on pages rendered by the plugin.
Track contributor-to-editor publishing workflows and flag posts containing raw HTML inside shortcode attributes.

How to Mitigate CVE-2025-14121

Immediate Actions Required

Deactivate the EDD Download Info plugin until a patched release is available.
Audit existing posts and pages for malicious payloads embedded in edd_download_info_link shortcode attributes and remove offending content.
Restrict contributor account registration and review the role assignments of existing low-privilege users.

Patch Information

At the time of NVD publication, no fixed version has been identified beyond 1.1. Site operators should monitor the plugin repository and the Wordfence Vulnerability Report for a vendor-supplied update and apply it immediately when published.

Workarounds

Remove the plugin entirely if the edd_download_info_link shortcode is not in active use on the site.
Deploy a Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Use a WordPress role manager to revoke shortcode usage from contributor-level accounts until a patch is available.

bash

# Disable the plugin from the WordPress CLI
wp plugin deactivate edd-download-info

# Search published content for vulnerable shortcode usage
wp post list --post_status=publish --format=ids \
  | xargs -I {} wp post get {} --field=content \
  | grep -n 'edd_download_info_link'