Easy Digital Downloads · Security record

Is Easy Digital Downloads safe?

No known vulnerability affects the current version (3.7.3). 88 issues were found in earlier versions and fixed, the latest disclosed on Nov 3, 2026.

Checked 4 days ago against the WPVulnerability database, for version 3.7.3.

How it’s looked after

Last release: Nov 2, 2026 (6 days ago)
Releases in the last year: 18
Tested up to: WordPress 7.1.4
Support resolved: 17 of 17 threads in two months
Active installs: 40K+

88 known vulnerabilities

5 critical
11 high
54 medium
2 low
16 not rated

None affects the current version.

Disclosed each year

201519
20162
20171
201916
20216
20225
20237
202412
20256
202612

Every known vulnerability in Easy Digital Downloads

Newest first, with any that affect the current version at the top.

high
Improper Authentication
Fixed in 3.7.3 · CVE-2026-120538 · Nov 3, 2026 · CVE
medium
Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
Fixed in 3.7.3 · CVE-2026-116403 · Oct 26, 2026 · Wordfence
high
Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Fixed in 3.6.9.1 · CVE-2026-14335 · Oct 8, 2026 · Wordfence
medium
Missing Authorization
Fixed in 3.7.1 · CVE-2026-105190 · Oct 8, 2026 · CVE
Authenticated (Subscriber+) Information Exposure
Fixed in 3.7.1 · CVE-2026-105194 · Oct 8, 2026 · Wordfence
high
Missing Authorization
Fixed in 3.7.1.1 · CVE-2026-42638 · Sep 23, 2026 · Wordfence
high
Authenticated (Shop Manager+) SQL Injection
Fixed in 3.7.1 · CVE-2026-95522 · Jul 28, 2026 · Wordfence
high
Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Fixed in 3.6.9.1 · CVE-2026-12476 · Jul 28, 2026 · Wordfence
Authenticated (Admin) Arbitrary File Deletion
Fixed in 3.6.9.1 · CVE-2026-66476 · Jul 27, 2026 · Wordfence
Missing Authorization
Fixed in 3.6.8 · CVE-2026-59524 · Jul 22, 2026 · Wordfence
medium
Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
Fixed in 3.6.8 · CVE-2026-7533 · May 27, 2026 · Wordfence
high
Missing Authorization
Fixed in 3.6.6 · CVE-2026-39503 · Apr 20, 2026 · Wordfence
medium
Unvalidated Redirect in Password Reset Flow via edd_redirect
Fixed in 3.6.3 · CVE-2025-14783 · Dec 30, 2025 · Wordfence
medium
Insufficient Verification to Order Manipulation
Fixed in 3.5.3 · CVE-2025-11271 · Nov 5, 2025 · Wordfence
medium
Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
Fixed in 3.5.1 · CVE-2025-8102 · Aug 19, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
Fixed in 3.3.9 · CVE-2025-4670 · May 28, 2025 · Wordfence
medium
Unauthenticated Private Post Title Disclosure
Fixed in 3.3.7 · CVE-2025-2252 · Mar 24, 2025 · Wordfence
medium
Authenticated (Admin+) Stored Cross-Site Scripting via Title
Fixed in 3.3.3 · CVE-2024-13517 · Jan 17, 2025 · Wordfence
medium
Authenticated (Admin+) Arbitrary File Download
Fixed in 3.3.3 · CVE-2024-12875 · Dec 20, 2024 · Wordfence
low
Improper Authorization to Paywall Bypass
Fixed in 3.3.5 · CVE-2024-9654 · Dec 16, 2024 · Wordfence
high
Authenticated (Admin+) PHAR Deserialization
Fixed in 3.3.4 · CVE-2022-2439 · Sep 23, 2024 · Wordfence
low
Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
Fixed in 3.3.3 · CVE-2024-6692 · Aug 9, 2024 · Wordfence
medium
Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
Fixed in 3.3.3 · CVE-2024-6691 · Aug 9, 2024 · Wordfence
high
Missing Authorization
Fixed in 3.3.1 · CVE-2024-43162 · Aug 7, 2024 · Wordfence
critical
Unauthenticated SQL Injection
Fixed in 3.3.1 · CVE-2024-5057 · Aug 1, 2024 · Wordfence
high
Unauthenticated Sensitive Information Exposure
Fixed in 3.2.12 · CVE-2024-32100 · May 9, 2024 · Wordfence
high
Cross-Site Request Forgery
Fixed in 3.2.12 · CVE-2024-31113 · May 9, 2024 · Wordfence
high
Cross-Site Request Forgery
Fixed in 3.2.7 · CVE-2024-31293 · Apr 5, 2024 · Wordfence
medium
Sensitive Information Exposure
Fixed in 3.2.10 · CVE-2024-2302 · Apr 3, 2024 · Wordfence
medium
Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
Fixed in 3.2.7 · CVE-2024-0659 · Feb 2, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 3.2.6 · CVE-2023-51684 · Dec 27, 2023 · Wordfence
medium
Missing Authorization
Fixed in 3.2.0 · CVE-2023-40005 · Dec 26, 2023 · Wordfence
WordPress Easy Digital Downloads Plugin <= 3.1.1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)
Fixed in 3.1.2 · Jun 8, 2023 · Patchstack
Cross-Site Request Forgery via edd_trigger_upgrades
Fixed in 3.1.2 · Jun 7, 2023 · Wordfence
critical
Unauthenticated Arbitrary Password Reset to Privilege Escalation
Affects 3.1.1.4.1 and earlier · CVE-2023-30869 · May 1, 2023 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in 3.1.0.5 · CVE-2023-0380 · Jan 30, 2023 · Wordfence
critical
SQL Injection
Fixed in 3.1.0.4 · CVE-2023-23489 · Jan 12, 2023 · Wordfence
medium
Cross-Site Request Forgery to Arbitrary Post Deletion
Fixed in 3.0 · CVE-2022-2387 · Oct 17, 2022 · Wordfence
critical
Unauthenticated CSV Injection
Fixed in 3.1.0.2 · CVE-2022-3600 · Sep 28, 2022 · Wordfence
medium
PHP Object Injection
Fixed in 3.1.1.4.2 · CVE-2022-33900 · Aug 10, 2022 · Wordfence
medium
Admin+ Cross-Site Scripting
Fixed in 2.11.6 · CVE-2022-0706 · Mar 28, 2022 · Wordfence
medium
Cross-Site Request Forgery
Fixed in 2.11.6 · CVE-2022-0707 · Mar 28, 2022 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.11.2.1 · CVE-2021-39354 · Oct 21, 2021 · Wordfence
Reflected Cross-Site Scripting
Fixed in 2.11.2.1 · Oct 19, 2021 · Wordfence
Reflected Cross-Site Scripting
Fixed in 2.10.4 · May 4, 2021 · Wordfence
Cross-Site Request Forgery
Fixed in 2.10.3 · Apr 16, 2021 · Wordfence
Cross-Site Request Forgery (CSRF) vulnerability
Fixed in 2.10.3 · Apr 16, 2021 · Patchstack
Cross-Site Request Forgery
Fixed in 2.10.3 · Apr 14, 2021 · Wordfence
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9525 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9534 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9521 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9535 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9516 · Oct 23, 2019 · CVE
medium
Cross-Site Scripting Issue
Fixed in 2.3.7 · CVE-2015-9531 · Oct 23, 2019 · WPScan
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9530 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9528 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9526 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9510 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9518 · Oct 23, 2019 · CVE
medium
Cross-site Scripting
Fixed in 2.3.7 · CVE-2015-9517 · Oct 23, 2019 · CVE
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9508 · Oct 14, 2019 · Wordfence
critical
SQL Injection
Fixed in 2.3.3 · CVE-2015-9324 · Aug 16, 2019 · Wordfence
Stored Cross-Site Scripting (XSS) vulnerability
Fixed in 2.9.16 · Jun 16, 2019 · Patchstack
medium
Stored Cross-Site Scripting
Fixed in 2.9.16 · CVE-2019-15116 · Jun 12, 2019 · Wordfence
Information Disclosure Vulnerability
Fixed in 2.8 · Mar 31, 2017 · Patchstack
PHP Object Injection
Fixed in 2.5.8 · Mar 2, 2016 · Wordfence
PHP Object Injection
Fixed in 2.5.8 · Mar 2, 2016 · Patchstack
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9536 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9532 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9529 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9527 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9523 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9524 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9522 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9514 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9520 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9519 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9533 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9515 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9513 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9512 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9505 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9511 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9509 · Apr 20, 2015 · Wordfence
medium
Reflected Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9507 · Apr 20, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.3.7 · CVE-2015-9506 · Apr 20, 2015 · Wordfence
PHP Object Injection
Fixed in 2.5.8 · WPScan
Unauthorised Stripe Disconnect via CSRF
Fixed in 2.10.3 · WPScan

Questions about Easy Digital Downloads’s security

Is Easy Digital Downloads safe to use?

No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep Easy Digital Downloads updated: most attacks target sites that haven’t updated.

Does Easy Digital Downloads have known security vulnerabilities?

None that affect the current version. WPVulnerability’s database lists 88 older issues, fixed in earlier versions, so keep Easy Digital Downloads up to date.

Is Easy Digital Downloads still maintained?

Yes. Its last release was 6 days ago. Its authors resolved 17 of the 17 support threads opened in the last two months.

Is Easy Digital Downloads compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.