The Easy Digital Downloads plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject arbitrary scripts via the Title field because input sanitization and output escaping are insufficient. This vulnerability affects all plugin versions up to and including 3.3.2, specifically in multi-site environments or where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access on affected WordPress multi-site installations or those with unfiltered_html disabled can inject persistent malicious scripts via the Title field. These scripts execute in the context of users visiting the compromised pages, potentially leading to partial confidentiality and integrity loss. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html if feasible. Monitor vendor channels for updates and apply patches promptly once released.