Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

easy-digital-downloads · plugin

Known security vulnerabilities for Easy Digital Downloads – eCommerce Payments and Subscriptions made easy. Find out in seconds which version runs on your site with WP Lens.

31 known vulnerabilities

4 critical · 18 exploitable without logging in · 3 with public exploit code · latest Oct 6, 2026

Listed on wordpress.org · latest 3.7.1.1 · last updated Oct 6, 2026 · 40K+ installs

wordpress.org status checked on Oct 8, 2026

Vulnerabilities

CVE-2023-40005unauthenticated≤ 3.1.5
WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control
Critical 9.8
CVE-2024-5057unauthenticated≤ 3.2.12
WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability
Critical 9.8
CVE-2023-30869unauthenticated≤ 3.1.1.4.1
WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation
Critical 9.8
CVE-2015-9324unauthenticated
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Critical 9.8
CVE-2024-31113unauthenticated · needs a click≤ 3.2.11
WordPress Easy Digital Downloads plugin <= 3.2.11 - Cross Site Request Forgery (CSRF) vulnerability
High 8.8
CVE-2024-31293unauthenticated · needs a click≤ 3.2.6
WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability
High 8.8
CVE-2024-43162login required≤ 3.2.12
WordPress Easy Digital Downloads plugin <= 3.2.12 - Broken Access Control vulnerability
High 8.8
CVE-2026-95522shop manager+≤ 3.7.0
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
High 7.6
CVE-2026-42638unauthenticated≤ 3.7.1
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
High 7.5
CVE-2026-39503unauthenticated≤ 3.6.5
WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability
High 7.5
CVE-2024-32100unauthenticated≤ 3.2.11
WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability
High 7.5
CVE-2026-12476shop manager+≤ 3.6.9
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
High 7.2
CVE-2022-2439admin≤ 3.3.3
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
High 7.2
CVE-2022-33900high privilege≤ 3.0.1
WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerability
High 7.2
CVE-2026-59524unauthenticated≤ 3.6.7
WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability
Medium 6.5
CVE-2019-15116unauthenticated · needs a click
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Medium 6.1
CVE-2025-8102unauthenticated · needs a click≤ 3.5.0
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
Medium 5.4
CVE-2023-51684login required≤ 3.2.5
WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)
Medium 5.4
CVE-2025-4670contributor+≤ 3.3.8.1
Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
Medium 5.4
CVE-2025-11271unauthenticated≤ 3.5.2
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
Medium 5.3
CVE-2025-2252unauthenticated≤ 3.3.6.1
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
Medium 5.3
CVE-2024-2302unauthenticated≤ 3.2.9
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure
Medium 5.3
CVE-2026-66476admin≤ 3.6.9
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Medium 4.9
CVE-2024-12875admin≤ 3.3.2
Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download
Medium 4.9
CVE-2021-39354high privilege≤ 2.11.2
Easy Digital Downloads <= 2.11.2 Authenticated Reflected Cross-Site Scripting
Medium 4.8
CVE-2026-7533unauthenticated · needs a click≤ 3.6.7
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
Medium 4.3
CVE-2025-14783unauthenticated · needs a click≤ 3.6.2
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
Medium 4.3
CVE-2024-13517admin≤ 3.3.2
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium 4.0
CVE-2024-6691admin≤ 3.3.2
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium 4.0
CVE-2024-9654unauthenticated≤ 3.3.4
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
Low 3.7
CVE-2024-6692admin≤ 3.3.2
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Low 3.1

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory