CVE-2026-14335: Easy Digital Downloads XSS Vulnerability

CVE-2026-14335 Overview

CVE-2026-14335 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Easy Digital Downloads – eCommerce Payments and Subscriptions plugin for WordPress. The flaw affects all versions up to and including 3.6.9 and stems from insufficient input sanitization and output escaping of PayPal Instant Payment Notification (IPN) parameters. Unauthenticated attackers can inject arbitrary web scripts that execute when administrators or other users view the affected pages, specifically the gateway error logs reporting view.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress admin pages, enabling session theft, administrative action hijacking, and backdoor installation when an administrator views gateway error logs.

Affected Products

Easy Digital Downloads – eCommerce Payments and Subscriptions WordPress plugin
All plugin versions <= 3.6.9
WordPress installations processing PayPal IPN messages through the affected plugin

Discovery Timeline

2026-10-10 - CVE-2026-14335 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-14335

Vulnerability Analysis

The vulnerability resides in the gateway error logs reporting component of Easy Digital Downloads, specifically in includes/admin/reporting/class-gateway-error-logs-list-table.php. The plugin logs PayPal IPN parameters received from external PayPal callback requests and later renders those parameters inside the WordPress admin interface. The rendering path fails to escape output properly, so attacker-controlled values stored during IPN processing are returned to administrators as live HTML.

Because PayPal IPN endpoints are reachable from the public internet and do not require authentication to the WordPress site, an attacker can submit crafted IPN payloads containing JavaScript. The malicious payload persists in the plugin's error log store and triggers whenever an authenticated administrator opens the gateway error logs page.

Root Cause

The root cause is missing input sanitization on inbound IPN parameters combined with missing output escaping when rendering those parameters in the admin list table. WordPress provides functions such as sanitize_text_field() for input handling and esc_html() or esc_attr() for output, but the vulnerable code path did not apply them consistently to IPN-derived fields.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction with the WordPress site. An attacker sends a specially crafted HTTP request to the plugin's PayPal IPN handler containing JavaScript inside one of the logged parameters. The script executes in the browser context of any WordPress administrator who subsequently views the gateway error logs page, inheriting their session privileges.

For technical specifics on the vulnerable code path, see the WordPress Changeset Update and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-14335

Indicators of Compromise

Entries in the gateway error logs containing HTML tags, <script> elements, event handlers such as onerror= or onload=, or javascript: URIs
Inbound HTTP POST requests to the plugin's PayPal IPN endpoint with payloads containing encoded script content
Unexpected administrative actions, new administrator accounts, or plugin installations occurring shortly after an administrator viewed the error logs page
Outbound requests from admin browser sessions to unfamiliar external domains originating from the WordPress admin context

Detection Strategies

Audit the Easy Digital Downloads gateway error log table for stored values containing HTML or script syntax
Review web server access logs for IPN callback requests containing characters such as <, >, or URL-encoded equivalents in parameter values
Monitor WordPress admin sessions for Content Security Policy violations or anomalous JavaScript execution
Correlate administrator login activity with subsequent privileged configuration changes to identify hijacked sessions

Monitoring Recommendations

Enable WordPress audit logging for user and role changes, plugin installations, and option updates
Deploy a web application firewall rule that inspects IPN endpoint parameters for XSS payload patterns
Alert on administrator-level API calls originating from unexpected IP addresses or user agents
Track plugin version inventory across WordPress fleets to confirm all instances are upgraded past 3.6.9

How to Mitigate CVE-2026-14335

Immediate Actions Required

Update the Easy Digital Downloads plugin to a version later than 3.6.9 that contains the fix referenced in changeset 3625073
Review gateway error logs for suspicious entries and purge any records containing script content
Rotate administrator credentials and invalidate active WordPress sessions if the error logs page was accessed while the plugin was vulnerable
Audit the WordPress site for unauthorized accounts, modified plugins, or injected content

Patch Information

The fix is delivered in the plugin trunk via WordPress Changeset 3625073, which updates class-gateway-error-logs-list-table.php to properly escape IPN-derived values before rendering. Install the latest plugin release from the WordPress plugin repository through the admin dashboard or via WP-CLI.

Workarounds

Restrict access to the WordPress admin area and reporting pages to trusted IP ranges using web server or firewall rules
Disable the Easy Digital Downloads PayPal gateway until the patched version is deployed if updating immediately is not feasible
Deploy a web application firewall rule that strips HTML metacharacters from IPN parameter values before they reach the plugin
Apply a Content Security Policy on the WordPress admin domain that disallows inline script execution

bash

# Update Easy Digital Downloads via WP-CLI
wp plugin update easy-digital-downloads
wp plugin get easy-digital-downloads --field=version