Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records
6Critical
5High
31Medium
2Low
0Informational
44Patched records
0Currently marked unpatched
2015-04-20First disclosure
2026-07-28Latest disclosure
38 of 44CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201522 records
201611 records
201911 records
202011 records
202155 records
202255 records
202366 records
20241212 records
202566 records
202655 records

Severity Breakdown

SeverityRecordsShare
Critical613.6%
High511.4%
Medium3170.5%
Low24.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records31.8%

First: 2015. Latest: 2025.

CSRF

9 records20.5%

First: 2021. Latest: 2026.

Other

6 records13.6%

First: 2016. Latest: 2025.

Missing Authorization

5 records11.4%

First: 2023. Latest: 2026.

SQL Injection

3 records6.8%

First: 2020. Latest: 2024.

Information Disclosure

3 records6.8%

First: 2024. Latest: 2025.

Path Traversal

2 records4.5%

First: 2024. Latest: 2026.

Privilege Escalation

1 record2.3%

First: 2023. Latest: 2023.

Arbitrary File Upload

1 record2.3%

First: 2026. Latest: 2026.

Patch Status

Patched
44
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 3.6.9.1
  • 3.6.8
  • 3.6.6
  • 3.6.3
  • 3.5.3
  • 3.5.1
  • 3.3.9
  • 3.3.7
  • 3.3.5
  • 3.3.4
  • 3.3.3
  • 3.3.1
  • 3.2.12
  • 3.2.10
  • 3.2.7
  • 3.2.6
  • 3.2.0
  • 3.1.2
  • 3.1.1.4.2
  • 3.1.0.5
  • 3.1.0.4
  • 3.0
  • 3.1.0.2
  • 3.0.2
  • 2.11.6
  • 2.11.2.1
  • 2.10.4
  • 2.10.3
  • 2.3.3
  • 2.9.16
  • 2.5.8
  • 2.3.7
  • 2.2.9
  • 2.1.11
  • 2.0.5
  • 1.9.10
  • 1.8.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 3.1.2)Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgradesJune 7, 20233.1.2Medium
[3.1, 3.1.1.4.2)Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege EscalationMay 2, 20233.1.1.4.2Critical
*-3.1.0.4Easy Digital Downloads <= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeJanuary 30, 20233.1.0.5Medium
*-3.1.0.3Easy Digital Downloads < 3.1.0.4 - SQL InjectionJanuary 12, 20233.1.0.4Critical
*-2.11.7Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post DeletionOctober 17, 20223.0High
*-3.1.0.1.1Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV InjectionSeptember 28, 20223.1.0.2High
*-3.0.1Easy Digital Downloads <= 3.0.1 - PHP Object InjectionAugust 10, 20223.0.2Critical
[*, 2.11.6)Easy Digital Downloads <= 2.11.5 - Cross-Site Request ForgeryApril 9, 20222.11.6High
[*, 2.11.6)Easy Digital Downloads <= 2.11.5 - Admin+ Cross-Site ScriptingMarch 28, 20222.11.6Medium
*-2.11.2Easy Digital Downloads <= 2.11.2 - Reflected Cross-Site ScriptingOctober 21, 20212.11.2.1Medium
*-2.11.2Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.11.2 - Reflected Cross-Site ScriptingOctober 19, 20212.11.2.1Medium
*-2.10.3Easy Digital Downloads <= 2.10.3 - Reflected Cross-Site ScriptingMay 4, 20212.10.4Medium
*-2.10.2Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.10.2 - Cross-Site Request ForgeryApril 16, 20212.10.3Medium
[*, 2.10.3)Easy Digital Downloads <= 2.10.2 - Cross-Site Request ForgeryApril 14, 20212.10.3Medium
*-2.3.2Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL InjectionSeptember 22, 20202.3.3Critical
[*, 2.9.16)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.9.15 - Stored Cross-Site ScriptingJune 12, 20192.9.16Medium
*-2.5.7Easy Digital Downloads <= 2.5.7 - PHP Object InjectionMarch 2, 20162.5.8Critical
[2.3, 2.3.7)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
[2.2, 2.2.9)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
[2.1, 2.1.11)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
[2.0, 2.0.5)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
[1.9, 1.9.10)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
[*, 1.8.7)Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
2.3-2.3.6Easy Digital Downloads (Various Versions) - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium
2.2-2.2.8Easy Digital Downloads (Various Versions) - Cross-Site ScriptingApril 20, 20151.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7Medium

Selected source records

Latest Records

HighCVE-2026-12476

Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

Published: July 28, 2026

Affected versions
*-3.6.9
Patched versions
3.6.9.1
Original Wordfence record
MediumCVE-2026-66476

Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion

Published: July 27, 2026

Affected versions
*-3.6.9
Patched versions
3.6.9.1
Original Wordfence record
MediumCVE-2026-59524

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization

Published: July 22, 2026

Affected versions
*-3.6.7
Patched versions
3.6.8
Original Wordfence record
MediumCVE-2026-7533

Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter

Published: May 27, 2026

Affected versions
*-3.6.7
Patched versions
3.6.8
Original Wordfence record
MediumCVE-2026-39503

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization

Published: April 20, 2026

Affected versions
*-3.6.5
Patched versions
3.6.6
Original Wordfence record
MediumCVE-2025-14783

Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect

Published: December 30, 2025

Affected versions
*-3.6.2
Patched versions
3.6.3
Original Wordfence record
MediumCVE-2025-11271

Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

Published: November 5, 2025

Affected versions
*-3.5.2
Patched versions
3.5.3
Original Wordfence record
MediumCVE-2025-8102

Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

Published: August 19, 2025

Affected versions
*-3.5.0
Patched versions
3.5.1
Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-5057

Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection

Published: August 1, 2024

Affected versions
*-3.2.12
Patched versions
3.3.1
Original Wordfence record
CriticalCVE-2023-23489

Easy Digital Downloads < 3.1.0.4 - SQL Injection

Published: January 12, 2023

Affected versions
*-3.1.0.3
Patched versions
3.1.0.4
Original Wordfence record
CriticalCVE-2015-9324

Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection

Published: September 22, 2020

Affected versions
*-2.3.2
Patched versions
2.3.3
Original Wordfence record
CriticalCVE-2023-30869

Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation

Published: May 2, 2023

Affected versions
[3.1, 3.1.1.4.2)
Patched versions
3.1.1.4.2
Original Wordfence record
Critical

Easy Digital Downloads <= 2.5.7 - PHP Object Injection

Published: March 2, 2016

Affected versions
*-2.5.7
Patched versions
2.5.8
Original Wordfence record
CriticalCVE-2022-33900

Easy Digital Downloads <= 3.0.1 - PHP Object Injection

Published: August 10, 2022

Affected versions
*-3.0.1
Patched versions
3.0.2
Original Wordfence record
HighCVE-2022-0707

Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery

Published: April 9, 2022

Affected versions
[*, 2.11.6)
Patched versions
2.11.6
Original Wordfence record
HighCVE-2022-3600

Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection

Published: September 28, 2022

Affected versions
*-3.1.0.1.1
Patched versions
3.1.0.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory