Plugin icon

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

easy-digital-downloads

Vulnerabilities:

34

Last Updated:

February 18, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2025-12-30
Title
Easy Digital Downloads < 3.6.3 - Unvalidated Redirect
Fixed in
Fixed in 3.6.3
CVSS
4.3 (medium)
Published
2025-11-05
Title
Easy Digital Download < 3.5.3 - Insufficient Verification to Order Manipulation
Fixed in
Fixed in 3.5.3
CVSS
5.3 (medium)
Published
2025-08-19
Title
Easy Digital Downloads < 3.5.1 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
Fixed in
Fixed in 3.5.1
CVSS
5.4 (medium)
Published
2025-05-28
Title
Easy Digital Downloads < 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
Fixed in
Fixed in 3.3.9
CVSS
6.4 (medium)
Published
2025-03-24
Title
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.3.7 - Unauthenticated Private Post Title Disclosure
Fixed in
Fixed in 3.3.7
CVSS
5.3 (medium)
Published
2025-01-17
Title
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) < 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Title
Fixed in
Fixed in 3.3.3
CVSS
4.4 (medium)
Published
2024-12-20
Title
Easy Digital Downloads < 3.3.3 - Authenticated (Admin+) Arbitrary File Download
Fixed in
Fixed in 3.3.3
CVSS
4.9 (medium)
Published
2024-12-16
Title
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
Fixed in
Fixed in 3.3.5
CVSS
3.7 (low)
Published
2024-09-23
Title
Easy Digital Downloads – Simple eCommerce for Selling Digital Files < 3.3.4 - Authenticated (Admin+) PHAR Deserialization
Fixed in
Fixed in 3.3.4
CVSS
7.2 (high)
Published
2024-08-09
Title
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) < 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
Fixed in
Fixed in 3.3.3
CVSS
3.3 (low)
Published
2024-08-09
Title
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) < 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
Fixed in
Fixed in 3.3.3
CVSS
4.4 (medium)
Published
2024-08-07
Title
Easy Digital Downloads < 3.3.1 - Missing Authorization
Fixed in
Fixed in 3.3.1
CVSS
4.3 (medium)
Published
2024-08-01
Title
Easy Digital Downloads < 3.3.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.3.1
CVSS
10 (critical)
Published
2024-05-09
Title
Easy Digital Downloads < 3.2.12 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 3.2.12
CVSS
5.3 (medium)
Published
2024-05-09
Title
Easy Digital Downloads < 3.2.12 - Cross-Site Request Forgery
Fixed in
Fixed in 3.2.12
CVSS
4.3 (medium)
Published
2024-04-05
Title
Easy Digital Downloads < 3.2.7 - Cross-Site Request Forgery
Fixed in
Fixed in 3.2.7
CVSS
4.3 (medium)
Published
2024-04-03
Title
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) < 3.2.10 - Sensitive Information Exposure
Fixed in
Fixed in 3.2.10
CVSS
5.3 (medium)
Published
2024-02-02
Title
Easy Digital Downloads < 3.2.7 - Shop Manager+ Stored XSS
Fixed in
Fixed in 3.2.7
CVSS
5.9 (medium)
Published
2023-12-27
Title
Easy Digital Downloads < 3.2.6 - Contributor+ Stored XSS
Fixed in
Fixed in 3.2.6
CVSS
5.9 (medium)
Published
2023-12-26
Title
Easy Digital Downloads < 3.2.0 - Missing Authorization
Fixed in
Fixed in 3.2.0
CVSS
5.3 (medium)
Published
2023-05-02
Title
Easy Digital Downloads < 3.1.1.4.2 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 3.1.1.4.2
CVSS
9.8 (critical)
Published
2023-01-30
Title
Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSS
Fixed in
Fixed in 3.1.0.5
CVSS
6.8 (medium)
Published
2023-01-12
Title
Easy Digital Downloads 3.1.0.2 & 3.1.0.3 - Unauthenticated SQLi
Fixed in
Fixed in 3.1.0.4
CVSS
8.6 (high)
Published
2022-10-17
Title
Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF
Fixed in
Fixed in 3.0
CVSS
6.5 (medium)
Published
2022-09-28
Title
Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection
Fixed in
Fixed in 3.1.0.2
CVSS
4.7 (medium)
Published
2022-08-10
Title
Easy Digital Downloads < 3.0.2 - Admin+ PHP Object Injection
Fixed in
Fixed in 3.0.2
CVSS
5.5 (medium)
Published
2022-03-28
Title
Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.11.6
CVSS
3.4 (low)
Published
2022-03-28
Title
Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF
Fixed in
Fixed in 2.11.6
CVSS
2.4 (low)
Published
2021-10-19
Title
Easy Digital Downloads < 2.11.2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.11.2.1
CVSS
8.8 (high)
Published
2021-04-16
Title
Easy Digital Downloads < 2.10.3 - Unauthorised Stripe Disconnect via CSRF
Fixed in
Fixed in 2.10.3
CVSS
5.4 (medium)
Published
2019-06-12
Title
Easy Digital Downloads <= 2.9.15 - Stored XSS
Fixed in
Fixed in 2.9.16
CVSS
6.1 (medium)
Published
2016-03-02
Title
Easy Digital Downloads < 2.5.8 - PHP Object Injection
Fixed in
Fixed in 2.5.8
CVSS
6.5 (medium)
Published
2015-04-20
Title
Multiple Easy Digital Downloads Plugins - Cross-Site Scripting Issue
Fixed in
Fixed in 2.3.7
CVSS
6.1 (medium)
Published
2015-03-18
Title
Easy Digital Downloads < 2.3.3 - SQL Injection
Fixed in
Fixed in 2.3.3
CVSS
9.8 (critical)