Input validation vulnerability in Easy Digital Downloads – Simple eCommerce for Selling Digital Files 2.11.2

The Easy Digital Downloads plugin for WordPress is vulnerable to a type of cyber attack called Reflected Cross-Site Scripting. This attack can occur in versions of the plugin up to and including 2.11.2 if the user is not careful. The attack is made possible when the ‘start-date’ and ‘end-date’ parameters are not properly sanitized and escaped. This means that if a user clicks on a malicious link, then malicious code could be executed on the page. To protect against this, users should make sure they only click on trusted links.