Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy, with AI-generated Chinese analysis, references, and POCs.

This page catalogs security vulnerabilities associated with Easy Digital Downloads, an eCommerce Payments and Subscriptions made easy plugin, categorized under weakness types and specific tags. It aggregates a comprehensive list of known security flaws, ranging from critical privilege escalations to less severe information disclosures, covering the entire historical timeline of reported issues for this specific product version and its related ecosystem. Visitors can utilize this resource to track a vendor's advisories, understand a weakness class by observing recurring patterns in similar codebases, or look up a product's vulnerability history to assess the security posture over time. The data includes detailed descriptions, severity scores, and references to relevant standards, enabling developers and administrators to prioritize remediation efforts effectively. By centralizing this information, the page serves as a critical reference for security professionals seeking to mitigate risks associated with widely used WordPress eCommerce plugins. Understanding the context and frequency of these vulnerabilities helps in implementing more robust defense strategies and staying compliant with industry security best practices. This collection is continuously updated to reflect the latest findings and patches, ensuring that users have access to current and accurate threat intelligence.

Vendor: smub

CVE IDTitleCVSSSeverityPublished
CVE-2026-12476 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter CWE-434 7.2 High2026-07-29
CVE-2026-7533 Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter CWE-352 4.3 Medium2026-05-28
CVE-2025-14783 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect CWE-640 4.3 Medium2025-12-31
CVE-2025-11271 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation CWE-807 5.3 Medium2025-11-06
CVE-2025-8102 Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions CWE-352 5.4 Medium2025-08-20
CVE-2025-4670 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode CWE-79 6.4 Medium2025-05-29
CVE-2025-2252 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure CWE-200 5.3 Medium2025-03-25
CVE-2024-13517 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title CWE-79 4.4 Medium2025-01-18
CVE-2024-12875 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download CWE-73 4.9 Medium2024-12-21
CVE-2024-9654 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass CWE-863 3.7 Low2024-12-17
CVE-2022-2439 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization CWE-502 7.2 High2024-09-24
CVE-2024-6692 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text CWE-79 3.3 Low2024-08-10
CVE-2024-6691 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings CWE-79 4.4 Medium2024-08-10
CVE-2024-2302 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure CWE-532 5.3 Medium2024-04-09
CVE-2024-0659 Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options CWE-79 5.5 Medium2024-02-05

All 15 known CVE vulnerabilities affecting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy with full Chinese analysis, references, and POCs where available.