Security readout for executives and security teams
Plain-English summary
This CVE concerns a cross-site scripting issue in the Easy Digital Downloads Shoppette WordPress theme when used with specified older EDD versions. A vulnerable site could expose visitors or administrators to browser-executed script. The source bundle names fixed version thresholds but provides no CVSS score or active exploitation evidence.
Executive priority
Treat this as a targeted legacy WordPress exposure review, not an emergency internet-wide incident based on current evidence. Prioritize any public commerce sites, especially those used by administrators or customers.
Technical view
The vulnerability is XSS caused by misuse of WordPress add_query_arg in the EDD Shoppette theme context. The CVE description lists affected EDD branches before 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, and 2.3.7. Product metadata in the CVE record is incomplete.
Likely exposure
Exposure is likely limited to WordPress sites using the Easy Digital Downloads Shoppette theme with EDD versions in the vulnerable ranges listed by the CVE.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Because this is XSS, practical impact depends on reachable vulnerable pages, user privileges, and whether administrators can be targeted.
Researcher notes
The CVE record lacks CVSS, CWE, CPE, and detailed affected product metadata. Analysis relies mainly on the CVE description and archived vendor reference. Avoid assuming exploitability beyond XSS from add_query_arg misuse.
Mitigation direction
- Inventory WordPress sites for the EDD Shoppette theme and Easy Digital Downloads versions.
- Upgrade affected EDD branches to the fixed versions named in the CVE or later.
- Check the archived vendor advisory for version-specific guidance before changing legacy sites.
- Remove or replace unsupported theme/plugin combinations if updates are unavailable.
Validation and detection
- Confirm whether Shoppette is active or installed on each WordPress site.
- Verify EDD version is at or above the fixed threshold for its branch.
- Review WordPress and web access logs for suspicious script-like query activity.
- Run authenticated staging checks after updates to confirm checkout and download flows still work.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9535 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://web.archive.org/web/20160921003517/https://easydigitaldownloads.com/blog/security-fix-released/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.