Is my WordPress plugin safe?

• Apr 1, 2025Ebook Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-31904 · affects up to 1.0 · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Cross Site Request Forgery.This issue affects Ebook Downloader: from n/a through <= 1.0.

  NVD recordpatchstack.com

• Apr 1, 2025Ebook Downloader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31894 · affects up to 1.0 · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stored XSS.This issue affects Ebook Downloader: from n/a through <= 1.0.

  NVD recordpatchstack.com

• Feb 12, 2025Ebook Downloader: SQL InjectionCVE-2024-13435 · affects up to 1.0 · reported by WordfenceHigh 7.5

  The Ebook Downloader plugin for WordPress is vulnerable to SQL Injection via the 'download' parameter in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgwordfence.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.