The Easy Digital Downloads – Sell Digital Files WordPress plugin (up to version 3.2.6) contains a stored cross-site scripting vulnerability (CWE-79) via the variable pricing option title. Authenticated users with shop manager privileges can inject arbitrary web scripts due to insufficient input sanitization and output escaping. This vulnerability allows script execution in the context of users who view the affected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 5.5 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix has been documented in the provided data.

An attacker with shop manager-level access can inject persistent malicious scripts into pages via the variable pricing option title. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user confidentiality and integrity. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager privileges to trusted users only and consider disabling or limiting the use of variable pricing options. Monitor vendor channels for updates and apply patches promptly once released.