CVE-2025-4670 is a stored Cross-Site Scripting (XSS) vulnerability identified in the WordPress plugin 'Easy Digital Downloads – eCommerce Payments and Subscriptions made easy' developed by smub. This vulnerability affects all versions up to and including 3.3.8.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the plugin's edd_receipt shortcode. Specifically, authenticated users with contributor-level access or higher can inject arbitrary malicious scripts into pages generated by this shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, privilege escalation, or unauthorized actions performed on behalf of the victim. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation. The CVSS v3.1 base score is 6.4, indicating a medium severity level, with attack vector being network (remote), low attack complexity, requiring privileges (contributor or above), no user interaction needed, and impacting confidentiality and integrity but not availability. No known exploits are currently reported in the wild, and no official patches or updates have been linked yet. This vulnerability is particularly critical for websites using this plugin to manage e-commerce payments and subscriptions, as exploitation could compromise customer data and site integrity.

For European organizations, this vulnerability poses a significant risk especially for small to medium-sized enterprises (SMEs) and e-commerce businesses relying on WordPress with the Easy Digital Downloads plugin. Exploitation could lead to unauthorized script execution, enabling attackers to steal sensitive customer information such as payment details, session cookies, or personal data, violating GDPR requirements and potentially resulting in regulatory penalties. Additionally, attackers could manipulate transaction data or perform fraudulent activities under the guise of legitimate users, damaging business reputation and customer trust. Since the vulnerability requires contributor-level access, insider threats or compromised accounts could be leveraged to initiate attacks. The stored nature of the XSS means that multiple users can be affected over time, increasing the scope of impact. Given the widespread use of WordPress in Europe and the popularity of e-commerce platforms, the threat could affect a broad range of sectors including retail, digital services, and subscription-based businesses.

1. Immediate mitigation involves restricting contributor-level access strictly to trusted users and reviewing user permissions to minimize the risk of malicious input. 2. Administrators should monitor and audit content submitted via the edd_receipt shortcode for suspicious scripts or anomalies. 3. Implement Web Application Firewalls (WAFs) with rules designed to detect and block XSS payloads targeting this plugin's shortcode parameters. 4. Employ Content Security Policy (CSP) headers to limit the execution of unauthorized scripts in browsers. 5. Regularly update the plugin once the vendor releases a patch addressing this vulnerability. 6. In the interim, consider disabling or removing the edd_receipt shortcode functionality if feasible, or sanitize inputs manually through custom code. 7. Educate content contributors about safe input practices and the risks of injecting scripts. 8. Conduct thorough security assessments and penetration testing focused on WordPress plugins and user-generated content to identify similar weaknesses.