Plugin security history

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

6Critical

5High

31Medium

2Low

0Informational

44Patched records

0Currently marked unpatched

2015-04-20First disclosure

2026-07-28Latest disclosure

38 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	2	2 records
2016	1	1 records
2019	1	1 records
2020	1	1 records
2021	5	5 records
2022	5	5 records
2023	6	6 records
2024	12	12 records
2025	6	6 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	6	13.6%
High	5	11.4%
Medium	31	70.5%
Low	2	4.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records31.8%

First: 2015. Latest: 2025.

CSRF

9 records20.5%

First: 2021. Latest: 2026.

Other

6 records13.6%

First: 2016. Latest: 2025.

Missing Authorization

5 records11.4%

First: 2023. Latest: 2026.

SQL Injection

3 records6.8%

First: 2020. Latest: 2024.

Information Disclosure

3 records6.8%

First: 2024. Latest: 2025.

Path Traversal

2 records4.5%

First: 2024. Latest: 2026.

Privilege Escalation

1 record2.3%

First: 2023. Latest: 2023.

Arbitrary File Upload

1 record2.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.6.9.1
3.6.8
3.6.6
3.6.3
3.5.3
3.5.1
3.3.9
3.3.7
3.3.5
3.3.4
3.3.3
3.3.1
3.2.12
3.2.10
3.2.7
3.2.6
3.2.0
3.1.2
3.1.1.4.2
3.1.0.5
3.1.0.4
3.0
3.1.0.2
3.0.2
2.11.6
2.11.2.1
2.10.4
2.10.3
2.3.3
2.9.16
2.5.8
2.3.7
2.2.9
2.1.11
2.0.5
1.9.10
1.8.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.6.9`	Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter	July 28, 2026	3.6.9.1	High
`*-3.6.9`	Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion	July 27, 2026	3.6.9.1	Medium
`*-3.6.7`	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization	July 22, 2026	3.6.8	Medium
`*-3.6.7`	Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter	May 27, 2026	3.6.8	Medium
`*-3.6.5`	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization	April 20, 2026	3.6.6	Medium
`*-3.6.2`	Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect	December 30, 2025	3.6.3	Medium
`*-3.5.2`	Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation	November 5, 2025	3.5.3	Medium
`*-3.5.0`	Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions	August 19, 2025	3.5.1	Medium
`*-3.3.8.1`	Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode	May 28, 2025	3.3.9	Medium
`*-3.3.6.1`	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure	March 24, 2025	3.3.7	Medium
`*-3.3.2`	Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title	January 17, 2025	3.3.3	Medium
`*-3.3.2`	Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download	December 20, 2024	3.3.3	Medium
`3.1-3.3.4`	Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass	December 16, 2024	3.3.5	Low
`*-3.3.3`	Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization	September 23, 2024	3.3.4	High
`*-3.3.2`	Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text	August 9, 2024	3.3.3	Low
`*-3.3.2`	Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings	August 9, 2024	3.3.3	Medium
`*-3.2.12`	Easy Digital Downloads <= 3.2.12 - Missing Authorization	August 7, 2024	3.3.1	Medium
`*-3.2.12`	Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection	August 1, 2024	3.3.1	Critical
`*-3.2.11`	Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure	May 9, 2024	3.2.12	Medium
`*-3.2.11`	Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery	May 9, 2024	3.2.12	Medium
`*-3.2.6`	Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery	April 5, 2024	3.2.7	Medium
`*-3.2.9`	Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure	April 3, 2024	3.2.10	Medium
`*-3.2.6`	Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options	February 2, 2024	3.2.7	Medium
`*-3.2.5`	Easy Digital Downloads <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 27, 2023	3.2.6	Medium
`*-3.1.5`	Easy Digital Downloads <= 3.1.5 - Missing Authorization	December 26, 2023	3.2.0	Medium

Selected source records

Latest Records

HighCVE-2026-12476

Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

Published: July 28, 2026

Affected versions: *-3.6.9
Patched versions: 3.6.9.1

Original Wordfence record

MediumCVE-2026-66476

Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion

Published: July 27, 2026

Affected versions: *-3.6.9
Patched versions: 3.6.9.1

Original Wordfence record

MediumCVE-2026-59524

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization

Published: July 22, 2026

Affected versions: *-3.6.7
Patched versions: 3.6.8

Original Wordfence record

MediumCVE-2026-7533

Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter

Published: May 27, 2026

Affected versions: *-3.6.7
Patched versions: 3.6.8

Original Wordfence record

MediumCVE-2026-39503

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization

Published: April 20, 2026

Affected versions: *-3.6.5
Patched versions: 3.6.6

Original Wordfence record

MediumCVE-2025-14783

Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect

Published: December 30, 2025

Affected versions: *-3.6.2
Patched versions: 3.6.3

Original Wordfence record

MediumCVE-2025-11271

Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

Published: November 5, 2025

Affected versions: *-3.5.2
Patched versions: 3.5.3

Original Wordfence record

MediumCVE-2025-8102

Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

Published: August 19, 2025

Affected versions: *-3.5.0
Patched versions: 3.5.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-5057

Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection

Published: August 1, 2024

Affected versions: *-3.2.12
Patched versions: 3.3.1

Original Wordfence record

CriticalCVE-2023-23489

Easy Digital Downloads < 3.1.0.4 - SQL Injection

Published: January 12, 2023

Affected versions: *-3.1.0.3
Patched versions: 3.1.0.4

Original Wordfence record

CriticalCVE-2015-9324

Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection

Published: September 22, 2020

Affected versions: *-2.3.2
Patched versions: 2.3.3

Original Wordfence record

CriticalCVE-2023-30869

Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation

Published: May 2, 2023

Affected versions: [3.1, 3.1.1.4.2)
Patched versions: 3.1.1.4.2

Original Wordfence record

Critical

Easy Digital Downloads <= 2.5.7 - PHP Object Injection

Published: March 2, 2016

Affected versions: *-2.5.7
Patched versions: 2.5.8

Original Wordfence record

CriticalCVE-2022-33900

Easy Digital Downloads <= 3.0.1 - PHP Object Injection

Published: August 10, 2022

Affected versions: *-3.0.1
Patched versions: 3.0.2

Original Wordfence record

HighCVE-2022-0707

Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery

Published: April 9, 2022

Affected versions: [*, 2.11.6)
Patched versions: 2.11.6

Original Wordfence record

HighCVE-2022-3600

Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection

Published: September 28, 2022

Affected versions: *-3.1.0.1.1
Patched versions: 3.1.0.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory