ED
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
16
CVEs
0
On KEV
7.2
Max CVSS
1
New 30D
Severity mix
Critical 0High 3Medium 11Low 2
Watch
Add Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14335 | 7.2 | Oct 10 | Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters Affected: through 3.6.9 |
| CVE-2026-12476 | 7.2 | Jul 29 | Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter Affected: through 3.6.9 |
| CVE-2022-2439 | 7.2 | Sep 24 | Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization Affected: through 3.3.3 |
| CVE-2025-8102 | 5.4 | Aug 20 | Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions Affected: through 3.5.0 |
| CVE-2025-4670 | 5.4 | May 29 | Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode Affected: through 3.3.8.1 |
| CVE-2025-11271 | 5.3 | Nov 6 | Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation Affected: through 3.5.2 |
| CVE-2025-2252 | 5.3 | Mar 25 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure Affected: through 3.3.6.1 |
| CVE-2024-2302 | 5.3 | Apr 9 | Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure Affected: through 3.2.9 |
| CVE-2024-12875 | 4.9 | Dec 21 | Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download Affected: through 3.3.2 |
| CVE-2024-0659 | 4.8 | Feb 5 | Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options Affected: through 3.2.6 |
| CVE-2026-7533 | 4.3 | May 28 | Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter Affected: through 3.6.7 |
| CVE-2025-14783 | 4.3 | Dec 31 | Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect Affected: through 3.6.2 |
| CVE-2024-13517 | 4.0 | Jan 18 | Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title Affected: through 3.3.2 |
| CVE-2024-6691 | 4.0 | Aug 10 | Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings Affected: through 3.3.2 |
| CVE-2024-9654 | 3.7 | Dec 17 | Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass Affected: 3.1 through 3.3.4 |
| CVE-2024-6692 | 3.1 | Aug 10 | Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text Affected: through 3.3.2 |
Showing 16