Cross-Site Scripting
14 records31.8%First: 2015. Latest: 2025.
Plugin security history
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, published between 2015 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
44Total records
6Critical
5High
31Medium
2Low
0Informational
44Patched records
0Currently marked unpatched
2015-04-20First disclosure
2026-07-28Latest disclosure
38 of 44CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2015 | 2 | |
| 2016 | 1 | |
| 2019 | 1 | |
| 2020 | 1 | |
| 2021 | 5 | |
| 2022 | 5 | |
| 2023 | 6 | |
| 2024 | 12 | |
| 2025 | 6 | |
| 2026 | 5 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 6 | 13.6% |
| High | 5 | 11.4% |
| Medium | 31 | 70.5% |
| Low | 2 | 4.5% |
Vulnerability-Type Breakdown
CSRF
9 records20.5%First: 2021. Latest: 2026.
Other
6 records13.6%First: 2016. Latest: 2025.
Missing Authorization
5 records11.4%First: 2023. Latest: 2026.
SQL Injection
3 records6.8%First: 2020. Latest: 2024.
Information Disclosure
3 records6.8%First: 2024. Latest: 2025.
Path Traversal
2 records4.5%First: 2024. Latest: 2026.
Privilege Escalation
1 record2.3%First: 2023. Latest: 2023.
Arbitrary File Upload
1 record2.3%First: 2026. Latest: 2026.
Patch Status
- Patched
- 44
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
3.6.9.13.6.83.6.63.6.33.5.33.5.13.3.93.3.73.3.53.3.43.3.33.3.13.2.123.2.103.2.73.2.63.2.03.1.23.1.1.4.23.1.0.53.1.0.43.03.1.0.23.0.22.11.62.11.2.12.10.42.10.32.3.32.9.162.5.82.3.72.2.92.1.112.0.51.9.101.8.7
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
2.1-2.1.10 | Easy Digital Downloads (Various Versions) - Cross-Site Scripting | April 20, 2015 | 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7 | Medium |
2.0-2.0.4 | Easy Digital Downloads (Various Versions) - Cross-Site Scripting | April 20, 2015 | 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7 | Medium |
1.9-1.9.9 | Easy Digital Downloads (Various Versions) - Cross-Site Scripting | April 20, 2015 | 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7 | Medium |
1.8-1.8.6 | Easy Digital Downloads (Various Versions) - Cross-Site Scripting | April 20, 2015 | 1.8.7, 1.9.10, 2.0.5, 2.1.11, 2.2.9, 2.3.7 | Medium |
Selected source records
Latest Records
HighCVE-2026-12476
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Published: July 28, 2026
- Affected versions
- *-3.6.9
- Patched versions
- 3.6.9.1
MediumCVE-2026-66476
Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion
Published: July 27, 2026
- Affected versions
- *-3.6.9
- Patched versions
- 3.6.9.1
MediumCVE-2026-59524
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization
Published: July 22, 2026
- Affected versions
- *-3.6.7
- Patched versions
- 3.6.8
MediumCVE-2026-7533
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
Published: May 27, 2026
- Affected versions
- *-3.6.7
- Patched versions
- 3.6.8
MediumCVE-2026-39503
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization
Published: April 20, 2026
- Affected versions
- *-3.6.5
- Patched versions
- 3.6.6
MediumCVE-2025-14783
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
Published: December 30, 2025
- Affected versions
- *-3.6.2
- Patched versions
- 3.6.3
MediumCVE-2025-11271
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
Published: November 5, 2025
- Affected versions
- *-3.5.2
- Patched versions
- 3.5.3
MediumCVE-2025-8102
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
Published: August 19, 2025
- Affected versions
- *-3.5.0
- Patched versions
- 3.5.1
Highest-Severity Records
CriticalCVE-2024-5057
Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection
Published: August 1, 2024
- Affected versions
- *-3.2.12
- Patched versions
- 3.3.1
CriticalCVE-2023-23489
Easy Digital Downloads < 3.1.0.4 - SQL Injection
Published: January 12, 2023
- Affected versions
- *-3.1.0.3
- Patched versions
- 3.1.0.4
CriticalCVE-2015-9324
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection
Published: September 22, 2020
- Affected versions
- *-2.3.2
- Patched versions
- 2.3.3
CriticalCVE-2023-30869
Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
Published: May 2, 2023
- Affected versions
- [3.1, 3.1.1.4.2)
- Patched versions
- 3.1.1.4.2
Critical
Easy Digital Downloads <= 2.5.7 - PHP Object Injection
Published: March 2, 2016
- Affected versions
- *-2.5.7
- Patched versions
- 2.5.8
CriticalCVE-2022-33900
Easy Digital Downloads <= 3.0.1 - PHP Object Injection
Published: August 10, 2022
- Affected versions
- *-3.0.1
- Patched versions
- 3.0.2
HighCVE-2022-0707
Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery
Published: April 9, 2022
- Affected versions
- [*, 2.11.6)
- Patched versions
- 2.11.6
HighCVE-2022-3600
Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection
Published: September 28, 2022
- Affected versions
- *-3.1.0.1.1
- Patched versions
- 3.1.0.2
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.