Security readout for executives and security teams
Plain-English summary
This CVE describes a cross-site scripting issue in the Easy Digital Downloads htaccess Editor extension for WordPress when used with older EDD branches. An attacker could potentially cause script execution in a user’s browser. The source bundle does not show active exploitation or a CVSS score.
Executive priority
Medium priority where affected WordPress commerce sites still exist. The issue is old and not KEV-listed, but XSS in an e-commerce admin ecosystem can still support account compromise or site manipulation if legacy software remains deployed.
Technical view
The vulnerability is XSS caused by misuse of WordPress add_query_arg in the EDD htaccess Editor extension. The CVE lists affected EDD lines before 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, and 2.3.7. No CWE, CVSS vector, or exploit details are provided.
Likely exposure
Exposure is likely limited to WordPress sites running the EDD htaccess Editor extension with the older EDD versions listed in the CVE description. Sites not using that extension are not shown as affected by the supplied sources.
Exploitation context
The bundle does not cite active exploitation, and the CVE is not marked KEV. Treat this as a historical WordPress plugin XSS issue requiring inventory validation, especially on long-lived sites with outdated EDD installations.
Researcher notes
The public data is sparse: no CVSS, CWE, detailed attack preconditions, or exploit status are provided. Analysis should stay anchored to the named extension, listed EDD version ranges, and the archived vendor security-fix reference.
Mitigation direction
- Upgrade EDD beyond the fixed version for the installed branch.
- Confirm the htaccess Editor extension is still required and maintained.
- Review the archived vendor security notice for branch-specific guidance.
- Remove unused WordPress extensions from production sites.
- Prioritize internet-facing WordPress stores with admin access exposure.
Validation and detection
- Inventory WordPress sites for Easy Digital Downloads and the htaccess Editor extension.
- Compare installed EDD versions against the CVE’s fixed version thresholds.
- Check plugin update history and deployment records for the vendor security fix.
- Review web logs for unusual requests to EDD administrative plugin pages.
- Confirm no vulnerable copies remain in staging or legacy environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9515 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://web.archive.org/web/20160921003517/https://easydigitaldownloads.com/blog/security-fix-released/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.