The Easy Digital Downloads plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the Agreement Text field. Authenticated users with administrator privileges can inject arbitrary scripts that execute when other users view the affected pages. This issue affects all versions up to 3.3.2 and is limited to multi-site setups or installations where unfiltered_html is disabled. The CVSS 3.1 base score is 3.3, reflecting low impact with network attack vector, high attack complexity, and required privileges.

Successful exploitation allows an authenticated administrator to inject persistent scripts that execute in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The impact is considered low due to the requirement for administrator privileges and the limited scope of the vulnerability. There are no reported availability impacts or known active exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit administrator access to trusted users only, and consider enabling unfiltered_html if feasible to reduce exposure. Monitor vendor channels for updates or official fixes addressing this vulnerability.