PT-2025-54286 · WordPress · Easy Digital Downloads

Angus Girvan · Published 2025-12-31 · Updated 2025-12-31 · CVE-2025-14783

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 3.6.3

Description The Easy Digital Downloads plugin for WordPress is susceptible to an unvalidated redirect issue. This occurs because of inadequate validation of the redirect URL provided through the edd redirect parameter. An attacker could potentially redirect users who request a password reset to a malicious site if they can trick the user into performing an action.

Recommendations Update Easy Digital Downloads to version 3.6.3 or later.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-14783

Affected Products

Easy Digital Downloads

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14783 · Security Note
• https://t.me/CVEtracker/41036 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3426524/easy-digital-downloads/trunk/includes/users/lost-password.php · Note
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/blocks/views/forms/lost-password.php#L24 · Note
• https://twitter.com/VulmonFeeds/status/2006269168610369915 · Twitter Post
• https://twitter.com/CVEnew/status/2006332206424416765 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3c0fb43c-f576-412e-a144-4725356ed9a0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/users/lost-password.php#L187 · Note
• https://t.me/cveNotify/147294 · Telegram Post