VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy security & vulnerabilities

easy-digital-downloads— active installsLast vulnerability Oct 30, 2026

No known unpatched vulnerabilities in the latest version

All 51 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
51Known vulnerabilities
  • Critical6
  • High7
  • Medium36
  • Low2
Vulnerabilities per year
2015: 2 vulnerabilities2152016: 1 vulnerability1162019: 1 vulnerability1192020: 1 vulnerability1202021: 5 vulnerabilities5212022: 5 vulnerabilities5222023: 6 vulnerabilities6232024: 12 vulnerabilities12242025: 6 vulnerabilities6252026: 12 vulnerabilities1226

All Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerabilities

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerabilities
SeverityVulnerabilityCVEPublished
High8.1Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
≤3.7.2Update to 3.7.3
CVE-2026-120538
Medium5.3Unauthenticated Discount Code Limit Bypass
≤3.7.1Update to 3.7.2
CVE-2026-116403
High7.2Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
≤3.6.9Update to 3.6.9.1
CVE-2026-14335
Medium4.3Authenticated (Subscriber+) Information Exposure
<3.7.1Update to 3.7.1
CVE-2026-105194
Medium5.3Unauthenticated Unauthorized Account Creation
≤3.7.0Update to 3.7.1
CVE-2026-105190
Medium5.3Missing Authorization
≤3.7.1Update to 3.7.1.1
CVE-2026-42638
Medium4.9Authenticated (Shop Manager+) SQL Injection
≤3.7.0Update to 3.7.1
CVE-2026-95522
High7.2Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
≤3.6.9Update to 3.6.9.1
CVE-2026-12476
Medium6.5Authenticated (Admin) Arbitrary File Deletion
≤3.6.9Update to 3.6.9.1
CVE-2026-66476
Medium5.3Missing Authorization
≤3.6.7Update to 3.6.8
CVE-2026-59524
Medium4.3Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
≤3.6.7Update to 3.6.8
CVE-2026-7533
Medium5.3Missing Authorization
≤3.6.5Update to 3.6.6
CVE-2026-39503
Medium4.3Unvalidated Redirect in Password Reset Flow via edd_redirect
≤3.6.2Update to 3.6.3
CVE-2025-14783
Medium5.3Insufficient Verification to Order Manipulation
≤3.5.2Update to 3.5.3
CVE-2025-11271
Medium5.4Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
≤3.5.0Update to 3.5.1
CVE-2025-8102
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
≤3.3.8.1Update to 3.3.9
CVE-2025-4670
Medium5.3Unauthenticated Private Post Title Disclosure
≤3.3.6.1Update to 3.3.7
CVE-2025-2252
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Title
≤3.3.2Update to 3.3.3
CVE-2024-13517
Medium4.9Authenticated (Admin+) Arbitrary File Download
≤3.3.2Update to 3.3.3
CVE-2024-12875
Low3.73.3.4 - Improper Authorization to Paywall Bypass
3.1 – 3.3.4Update to 3.3.5
CVE-2024-9654
High7.2Authenticated (Admin+) PHAR Deserialization
≤3.3.3Update to 3.3.4
CVE-2022-2439
Low3.3Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
≤3.3.2Update to 3.3.3
CVE-2024-6692
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
≤3.3.2Update to 3.3.3
CVE-2024-6691
Medium4.3Missing Authorization
≤3.2.12Update to 3.3.1
CVE-2024-43162
Critical10.0Unauthenticated SQL Injection
≤3.2.12Update to 3.3.1
CVE-2024-5057
Medium4.3Cross-Site Request Forgery
≤3.2.11Update to 3.2.12
CVE-2024-31113
Medium5.3Unauthenticated Sensitive Information Exposure
≤3.2.11Update to 3.2.12
CVE-2024-32100
Medium4.3Cross-Site Request Forgery
≤3.2.6Update to 3.2.7
CVE-2024-31293
Medium5.3Sensitive Information Exposure
≤3.2.9Update to 3.2.10
CVE-2024-2302
Medium5.5Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
≤3.2.6Update to 3.2.7
CVE-2024-0659
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.5Update to 3.2.6
CVE-2023-51684
Medium5.3Missing Authorization
≤3.1.5Update to 3.2.0
CVE-2023-40005
Medium4.3Cross-Site Request Forgery via edd_trigger_upgrades
<3.1.2Update to 3.1.2
—
Critical9.83.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
3.1 – <3.1.1.4.2Update to 3.1.1.4.2
CVE-2023-30869
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.1.0.4Update to 3.1.0.5
CVE-2023-0380
Critical9.8SQL Injection
≤3.1.0.3Update to 3.1.0.4
CVE-2023-23489
High8.8Cross-Site Request Forgery to Arbitrary Post Deletion
≤2.11.7Update to 3.0
CVE-2022-2387
High8.8Unauthenticated CSV Injection
≤3.1.0.1.1Update to 3.1.0.2
CVE-2022-3600
Critical9.8PHP Object Injection
≤3.0.1Update to 3.0.2
CVE-2022-33900
High8.8Cross-Site Request Forgery
<2.11.6Update to 2.11.6
CVE-2022-0707
Medium5.5Admin+ Cross-Site Scripting
<2.11.6Update to 2.11.6
CVE-2022-0706
Medium4.8Reflected Cross-Site Scripting
≤2.11.2Update to 2.11.2.1
CVE-2021-39354
Medium5.4Reflected Cross-Site Scripting
≤2.11.2Update to 2.11.2.1
—
Medium6.1Reflected Cross-Site Scripting
≤2.10.3Update to 2.10.4
—
Medium4.3Cross-Site Request Forgery
≤2.10.2Update to 2.10.3
—
Medium4.3Cross-Site Request Forgery
<2.10.3Update to 2.10.3
—
Critical9.8SQL Injection
≤2.3.2Update to 2.3.3
CVE-2015-9324
Medium6.1Stored Cross-Site Scripting
<2.9.16Update to 2.9.16
CVE-2019-15116
Critical9.8PHP Object Injection
≤2.5.7Update to 2.5.8
—
Medium6.1Cross-Site Scripting
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9512
Medium6.1Cross-Site Scripting
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: common questions

Does Easy Digital Downloads – eCommerce Payments and Subscriptions made easy have known vulnerabilities?

Yes. VulnCrest Radar lists 51 known vulnerabilities in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: 6 critical, 7 high, 36 medium, 2 low. None are known to affect version null.

How do I check which version of Easy Digital Downloads – eCommerce Payments and Subscriptions made easy I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerability?

CVE-2026-120538, published Oct 30, 2026: Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture. Severity: High (CVSS 8.1).

Is any Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerability listed in CISA KEV?

No. None of the known Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?