Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?easy-digital-downloadsWezido
Plugin · easy-digital-downloads
easy-digital-downloads
41 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 26, 2026Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-116403 · affects up to 3.7.1 · reported by PatchstackMedium 5.9
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Oct 10, 2026Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2026-14335 · affects up to 3.6.9 · reported by WordfenceHigh 7.2
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Oct 8, 2026Easy Digital Downloads: Does not consult the site's user registration setting before creating a WordPress accountCVE-2026-105190 · fixed in 3.7.1 · reported by WPScanMedium 5.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
Oct 8, 2026Easy Digital Downloads: Does not restrict a block's order data to the current userCVE-2026-105194 · fixed in 3.7.1 · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
Oct 6, 2026Easy Digital Downloads: Missing AuthorizationCVE-2026-42638 · affects up to 3.7.1 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Sep 23, 2026Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.CVE-2026-95522 · affects up to 3.7.0 · reported by PatchstackHigh 7.6
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Jul 29, 2026Easy Digital Downloads: Arbitrary File UploadCVE-2026-12476 · affects up to 3.6.9 · reported by WordfenceHigh 7.2
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.CVE-2026-66476 · affects up to 3.6.9 · reported by PatchstackMedium 4.9
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
Jul 23, 2026Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.CVE-2026-59524 · affects up to 3.6.7 · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
Jun 15, 2026Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.CVE-2026-39503 · affects up to 3.6.5 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
May 28, 2026Easy Digital Downloads: Cross-Site Request ForgeryCVE-2026-7533 · affects up to 3.6.7 · reported by WordfenceMedium 4.3
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2025Easy Digital Downloads: Unvalidated RedirectCVE-2025-14783 · affects up to 3.6.2 · reported by WordfenceMedium 4.3
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Easy Digital Downloads: Order ManipulationCVE-2025-11271 · affects up to 3.5.2 · reported by WordfenceMedium 5.3
The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.
Aug 20, 2025Easy Digital Downloads: Cross-Site Request ForgeryCVE-2025-8102 · affects up to 3.5.0 · reported by WordfenceMedium 5.4
The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 29, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2025-4670 · affects up to 3.3.8.1 · reported by WordfenceMedium 6.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 25, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Sensitive Information ExposureCVE-2025-2252 · affects up to 3.3.6.1 · reported by WordfenceMedium 5.3
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2024-13517 · affects up to 3.3.2 · reported by WordfenceMedium 4.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Dec 21, 2024Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Directory TraversalCVE-2024-12875 · affects up to 3.3.2 · reported by WordfenceMedium 4.9
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Dec 17, 2024Easy Digital Downloads: Improper AuthorizationCVE-2024-9654 · affects up to 3.3.4 · reported by WordfenceLow 3.7
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.
Dec 13, 2024Easy Digital Downloads: Missing AuthorizationCVE-2023-40005 · affects up to 3.1.5 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.
Nov 1, 2024Easy Digital Downloads: Missing AuthorizationCVE-2024-43162 · affects up to 3.2.12 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
Sep 23, 2024Easy Digital Downloads – Simple eCommerce for Selling Digital Files: Deserialization of untrusted inputCVE-2022-2439 · affects up to 3.3.3 · reported by WordfenceHigh 7.2
The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Easy Digital Downloads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-5057 · affects up to 3.2.12 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
Aug 12, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Stored Cross-Site ScriptingCVE-2024-6692 · affects up to 3.3.2 · reported by WordfenceLow 3.3
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Aug 12, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Stored Cross-Site ScriptingCVE-2024-6691 · affects up to 3.3.2 · reported by WordfenceMedium 4.4
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
May 14, 2024Easy Digital Downloads: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32100 · affects up to 3.2.11 · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
May 14, 2024Easy Digital Downloads: Cross-Site Request Forgery (CSRF)CVE-2024-31113 · affects up to 3.2.11 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
Apr 12, 2024Easy Digital Downloads: Cross-Site Request Forgery (CSRF)CVE-2024-31293 · affects up to 3.2.6 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6.
Apr 9, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Sensitive Information ExposureCVE-2024-2302 · affects up to 3.2.9 · reported by WordfenceMedium 5.3
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2024Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): Stored Cross-Site ScriptingCVE-2024-0659 · affects up to 3.2.6 · reported by WordfenceMedium 5.5
The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 1, 2024Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51684 · affects up to 3.2.5 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.
May 2, 2023Easy Digital Downloads: Improper AuthenticationCVE-2023-30869 · affects up to 3.1.1.4.1 · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · fixed in 3.1.0.5 · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Nov 21, 2022Easy Digital Downloads: Does not validate dataCVE-2022-3600 · fixed in 3.1.0.2 · reported by WPScanCritical 9.8
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
Nov 7, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-2387 · fixed in 3.0 · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
Aug 22, 2022PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.CVE-2022-33900 · affects up to 3.0.1 · reported by PatchstackMedium 4.1
PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.
Apr 18, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-0707 · fixed in 2.11.6 · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · fixed in 2.11.6 · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Oct 21, 2021Easy Digital Downloads: Reflected Cross-Site ScriptingCVE-2021-39354 · affects up to 2.11.2 · reported by WordfenceMedium 4.8
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
Aug 16, 2019The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-15116 · fixed in 2.9.16 · reported by MITREMedium 6.1
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Aug 16, 2019The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.CVE-2015-9324 · fixed in 2.3.3 · reported by MITRECritical 9.8
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.