CVE-2025-4670 Overview
CVE-2025-4670 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Digital Downloads plugin for WordPress. The flaw affects all versions up to and including 3.3.8.1. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's edd_receipt shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the compromised page. The issue is classified under CWE-79.
Critical Impact
Contributor-level accounts can persist malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and administrative action forgery.
Affected Products
- Awesomemotive Easy Digital Downloads for WordPress, all versions up to and including 3.3.8.1
- WordPress sites using the edd_receipt shortcode
- Deployments allowing contributor-level or higher user registration
Discovery Timeline
- 2025-05-29 - CVE-2025-4670 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4670
Vulnerability Analysis
The vulnerability resides in the handling of shortcode attributes within the Easy Digital Downloads plugin. The edd_receipt shortcode accepts user-supplied attributes that are rendered into page output without adequate sanitization or escaping. An authenticated user with contributor privileges can embed the shortcode in a post or page with attribute values containing JavaScript payloads. When the resulting page is rendered, the payload executes in the visitor's browser under the site's origin.
Stored XSS in an eCommerce plugin is particularly consequential. Administrators reviewing contributor-submitted content are likely targets, and script execution in an administrator's session can lead to full site compromise via authenticated REST API calls or nonce theft. The vulnerability requires user interaction, and the scope is changed because the executed script crosses trust boundaries between the contributor and the viewing user.
Root Cause
The root cause is missing input sanitization on shortcode attributes combined with missing output escaping when the attributes are echoed into HTML context. WordPress provides helpers such as sanitize_text_field(), esc_attr(), and esc_html() for these tasks, but the vulnerable code path does not apply them consistently to the attributes accepted by edd_receipt.
Attack Vector
Exploitation requires an authenticated account with at least contributor-level privileges. The attacker creates or edits a post that embeds the edd_receipt shortcode with a malicious attribute value containing HTML or JavaScript. Once the content is published or previewed, any user rendering that page triggers the payload. Refer to the Wordfence Vulnerability Report for additional technical context.
No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the WordPress Changeset Update for the upstream fix.
Detection Methods for CVE-2025-4670
Indicators of Compromise
- Post or page content containing [edd_receipt] shortcode with attribute values that include <script> tags, javascript: URIs, or HTML event handlers such as onerror and onload.
- New or unexpected contributor-level accounts creating or editing content that references the edd_receipt shortcode.
- Outbound requests from visitor browsers to attacker-controlled domains sourced from WordPress pages containing the shortcode.
Detection Strategies
- Query the WordPress wp_posts table for post_content values matching edd_receipt combined with HTML tag characters or JavaScript keywords in attribute positions.
- Enable and monitor WordPress audit logs for post creation and modification events by contributor-level users.
- Deploy a web application firewall rule set that inspects rendered HTML for reflected or stored script payloads adjacent to plugin shortcodes.
Monitoring Recommendations
- Alert on Content Security Policy (CSP) violation reports originating from pages that render receipt content.
- Track failed and successful logins for low-privilege accounts, and flag privilege changes on those accounts.
- Monitor plugin version inventory across WordPress deployments and alert when Easy Digital Downloads is below the patched release.
How to Mitigate CVE-2025-4670
Immediate Actions Required
- Update the Easy Digital Downloads plugin to a version later than 3.3.8.1 on every WordPress site in the estate.
- Audit existing pages and posts that use the edd_receipt shortcode for injected script content and remove any malicious markup.
- Review contributor and author accounts, disable unused accounts, and rotate credentials on any account suspected of abuse.
Patch Information
Awesomemotive addressed the vulnerability in a release following 3.3.8.1. The upstream code change is available in the WordPress Changeset 3301852. Administrators should install the latest release from the Easy Digital Downloads plugin page and verify the version through the WordPress plugins dashboard.
Workarounds
- Restrict content creation to trusted editor-level or administrator-level accounts until the patch is applied.
- Remove the edd_receipt shortcode from published pages if the receipt display is not currently required.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
# Update Easy Digital Downloads via WP-CLI
wp plugin update easy-digital-downloads
wp plugin get easy-digital-downloads --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
