Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

Information

Software Type Plugin
Software Slug easy-digital-downloads (view on wordpress.org)
Software Status Active
Software Author smub
Software Website easydigitaldownloads.com
Software Downloads 6,019,938
Software Active Installs 40,000
Software Record Last Updated July 18, 2026

Showing 1-20 of 41 Vulnerabilities

Submit a Vulnerability
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
4.3
CVE-2026-7533
May 27, 2026
Researcher: type5afe
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization
5.3
CVE-2026-39503
Apr 20, 2026
Researcher: Jakub Herman
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
4.3
CVE-2025-14783
Dec 30, 2025
Researcher: shark3y
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
5.3
CVE-2025-11271
Nov 5, 2025
Researcher: Jay
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
5.4
CVE-2025-8102
Aug 19, 2025
Researcher: wesley (wcraft)
Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
6.4
CVE-2025-4670
May 28, 2025
Researcher: Muhammad Yudha - DJ
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
5.3
CVE-2025-2252
Mar 24, 2025
Researcher: Françoa Taffarel
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title
4.4
CVE-2024-13517
Jan 17, 2025
Researcher: Sajjad Ahmad (jack_sparrow)
Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download
4.9
CVE-2024-12875
Dec 20, 2024
Researcher: Sajjad Ahmad (jack_sparrow)
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
3.7
CVE-2024-9654
Dec 16, 2024
Researcher: Arkadiusz Hydzik
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
7.2
CVE-2022-2439
Sep 23, 2024
Researcher: Rasoul Jahanshahi
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
4.4
CVE-2024-6691
Aug 9, 2024
Researcher: Jonas Benjamin Friedli
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
3.3
CVE-2024-6692
Aug 9, 2024
Researcher: Jonas Benjamin Friedli
Easy Digital Downloads <= 3.2.12 - Missing Authorization
4.3
CVE-2024-43162
Aug 7, 2024
Researcher: akas wisnu aji
Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection
10.0
CVE-2024-5057
Aug 1, 2024
Researcher: akas wisnu aji
Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery
4.3
CVE-2024-31113
May 9, 2024
Researcher: Dhabaleshwar Das
Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-32100
May 9, 2024
Researcher: Dhabaleshwar Das
Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery
4.3
CVE-2024-31293
Apr 5, 2024
Researcher: Dhabaleshwar Das
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure
5.3
CVE-2024-2302
Apr 3, 2024
Researcher: Colin Xu
Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
5.5
CVE-2024-0659
Feb 2, 2024
Researcher: emad
Title Status CVE ID CVSS Researchers Date
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter Patched CVE-2026-7533 4.3 type5afe May 27, 2026
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization Patched CVE-2026-39503 5.3 Jakub Herman April 20, 2026
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect Patched CVE-2025-14783 4.3 shark3y December 30, 2025
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation Patched CVE-2025-11271 5.3 Jay November 5, 2025
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions Patched CVE-2025-8102 5.4 wesley (wcraft) August 19, 2025
Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode Patched CVE-2025-4670 6.4 Muhammad Yudha - DJ May 28, 2025
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure Patched CVE-2025-2252 5.3 Françoa Taffarel March 24, 2025
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title Patched CVE-2024-13517 4.4 Sajjad Ahmad (jack_sparrow) January 17, 2025
Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download Patched CVE-2024-12875 4.9 Sajjad Ahmad (jack_sparrow) December 20, 2024
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass Patched CVE-2024-9654 3.7 Arkadiusz Hydzik December 16, 2024
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization Patched CVE-2022-2439 7.2 Rasoul Jahanshahi September 23, 2024
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings Patched CVE-2024-6691 4.4 Jonas Benjamin Friedli August 9, 2024
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text Patched CVE-2024-6692 3.3 Jonas Benjamin Friedli August 9, 2024
Easy Digital Downloads <= 3.2.12 - Missing Authorization Patched CVE-2024-43162 4.3 akas wisnu aji August 7, 2024
Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection Patched CVE-2024-5057 10.0 akas wisnu aji August 1, 2024
Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery Patched CVE-2024-31113 4.3 Dhabaleshwar Das May 9, 2024
Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure Patched CVE-2024-32100 5.3 Dhabaleshwar Das May 9, 2024
Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery Patched CVE-2024-31293 4.3 Dhabaleshwar Das April 5, 2024
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure Patched CVE-2024-2302 5.3 Colin Xu April 3, 2024
Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options Patched CVE-2024-0659 5.5 emad February 2, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation