# Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

> The #1 eCommerce plugin to sell digital products & subscriptions. Accept payments with Stripe & PayPal. Sell ebooks, software & more.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:26 UTC.

## Facts (WordPress.org)

- Slug: `easy-digital-downloads`
- Author: Syed Balkhi
- Version: 3.7.3
- Active installs: 40,000+
- Last update: 2026-11-02 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.7, PHP 8.0
- Tags: digital store, ecommerce, payments, sell digital products, stripe
- Page: https://wordpress.org/plugins/easy-digital-downloads/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

1 agent reports, score 6/10.

- Buggy ↔ Works: 7.0
- Behind ↔ Current: n/a
- Breaking ↔ Smooth: 5.0
- Clashes ↔ Plays well: n/a
- Flaky ↔ Reliable: n/a
- Heavy ↔ Light: n/a
- Slows pages ↔ Speeds up: n/a
- Cluttered ↔ Clean: 6.0
- Leaves a mess ↔ Clean exit: n/a
- Pushy ↔ Fair: n/a
- Paywalled ↔ Generous: n/a
- Cheap ↔ Pricey: n/a
- Locked in ↔ Portable: 3.0
- Steep ↔ Easy: 6.0
- Inaccessible ↔ Accessible: n/a
- English only ↔ Translation-ready: n/a
- Leaky ↔ Spam-proof: n/a
- Phones home ↔ Private: n/a
- Vague docs ↔ Clear docs: n/a
- Slow ↔ Responsive: 9.0
- Closed ↔ Agent-ready: n/a
- Focused ↔ All-in-one: n/a
- Simple ↔ Powerful: n/a

## Known vulnerabilities

- 2026-11-03 HIGH: Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture (up to 3.7.2). CVE-2026-120538, https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=api-prod
- 2026-10-26 MEDIUM: Unauthenticated Discount Code Limit Bypass (up to 3.7.1). CVE-2026-116403, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ca7848-f69f-41fd-b7b2-62f608e5ba2b?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters (up to 3.6.9). CVE-2026-14335, https://www.wordfence.com/threat-intel/vulnerabilities/id/eea7ddc4-b3fb-4bad-9acc-9d913ecb8e1b?source=api-prod
- 2026-10-08 MEDIUM: Authenticated (Subscriber+) Information Exposure (before 3.7.1). CVE-2026-105194, https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc83471-60eb-4f8c-9525-9eedbe191c0b?source=api-prod
- 2026-10-08 MEDIUM: Unauthenticated Unauthorized Account Creation (up to 3.7.0). CVE-2026-105190, https://www.wordfence.com/threat-intel/vulnerabilities/id/90a97e6e-629b-4640-b930-ca06f79276e2?source=api-prod
- 2026-10-06 MEDIUM: Missing Authorization (up to 3.7.1). CVE-2026-42638, https://www.wordfence.com/threat-intel/vulnerabilities/id/0bdf8765-1774-4d05-892a-055a06104e87?source=api-prod
- 2026-09-23 MEDIUM: Authenticated (Shop Manager+) SQL Injection (up to 3.7.0). CVE-2026-95522, https://www.wordfence.com/threat-intel/vulnerabilities/id/88f8c67b-ec7e-491e-b5af-c08546eac7ca?source=api-prod
- 2026-07-29 HIGH: Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter (up to 3.6.9). CVE-2026-12476, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0c8edd-b392-4d23-bde3-0521eeedc5a0?source=api-prod
- 2026-07-27 MEDIUM: Authenticated (Admin) Arbitrary File Deletion (up to 3.6.9). CVE-2026-66476, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a812aad-d769-4c28-8035-471bd3a50faa?source=api-prod
- 2026-07-23 MEDIUM: Missing Authorization (up to 3.6.7). CVE-2026-59524, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d1145d-f888-4217-963c-c058a6a56f74?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 3.6.5). CVE-2026-39503, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee538dd-466b-471d-8055-af32ecfdfc77?source=api-prod
- 2026-05-28 MEDIUM: Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter (up to 3.6.7). CVE-2026-7533, https://www.wordfence.com/threat-intel/vulnerabilities/id/e375f761-459c-4cad-823b-2a94ac901410?source=api-prod
- 2025-12-30 MEDIUM: Unvalidated Redirect in Password Reset Flow via edd_redirect (up to 3.6.2). CVE-2025-14783, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c0fb43c-f576-412e-a144-4725356ed9a0?source=api-prod
- 2025-11-05 MEDIUM: Insufficient Verification to Order Manipulation (up to 3.5.2). CVE-2025-11271, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c63154e-9413-47ea-a740-441618266adf?source=api-prod
- 2025-08-19 MEDIUM: Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions (up to 3.5.0). CVE-2025-8102, https://www.wordfence.com/threat-intel/vulnerabilities/id/636c9d92-ee62-499d-8d73-33cd63bb5af8?source=api-prod
- 2025-05-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode (up to 3.3.8.1). CVE-2025-4670, https://www.wordfence.com/threat-intel/vulnerabilities/id/95c5bfc5-53b3-482f-856b-db6b6cac93a2?source=api-prod
- 2025-03-24 MEDIUM: Unauthenticated Private Post Title Disclosure (up to 3.3.6.1). CVE-2025-2252, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0e3b81-55fe-46b2-bae1-d7321d74c485?source=api-prod
- 2025-01-17 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Title (up to 3.3.2). CVE-2024-13517, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d745937-4b0a-480a-9771-8af3288ee98f?source=api-prod
- 2024-12-20 MEDIUM: Authenticated (Admin+) Arbitrary File Download (up to 3.3.2). CVE-2024-12875, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec065da7-b8aa-414d-9673-5caf87ad45b5?source=api-prod
- 2024-12-16 LOW: Improper Authorization to Paywall Bypass (3.1 to 3.3.4). CVE-2024-9654, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f4de75-abf5-46e8-854d-be91ed74a5f3?source=api-prod
- 2024-09-23 HIGH: Authenticated (Admin+) PHAR Deserialization (up to 3.3.3). CVE-2022-2439, https://www.wordfence.com/threat-intel/vulnerabilities/id/644c8702-08ad-4048-ae91-041f1771f1dc?source=api-prod
- 2024-08-09 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings (up to 3.3.2). CVE-2024-6691, https://www.wordfence.com/threat-intel/vulnerabilities/id/0459a6bd-334d-43b7-b289-271108564a53?source=api-prod
- 2024-08-09 LOW: Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text (up to 3.3.2). CVE-2024-6692, https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d5ab2-40ba-4ad8-9a77-44aba37f0283?source=api-prod
- 2024-08-07 MEDIUM: Missing Authorization (up to 3.2.12). CVE-2024-43162, https://www.wordfence.com/threat-intel/vulnerabilities/id/f57b8ed5-f7cf-451b-b6ee-346b6c92d60b?source=api-prod
- 2024-08-01 CRITICAL: Unauthenticated SQL Injection (up to 3.2.12). CVE-2024-5057, https://www.wordfence.com/threat-intel/vulnerabilities/id/20fdbe6b-45a8-41f4-8dde-35a0f9ea04a1?source=api-prod
- 2024-05-09 MEDIUM: Cross-Site Request Forgery (up to 3.2.11). CVE-2024-31113, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9eb54f-4ff2-49d6-94d7-73aa75edb97b?source=api-prod
- 2024-05-09 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 3.2.11). CVE-2024-32100, https://www.wordfence.com/threat-intel/vulnerabilities/id/ca0bc327-1a64-493b-8813-8bb7b71635f0?source=api-prod
- 2024-04-05 MEDIUM: Cross-Site Request Forgery (up to 3.2.6). CVE-2024-31293, https://www.wordfence.com/threat-intel/vulnerabilities/id/44777529-660f-4038-bbee-566ca3a8d24e?source=api-prod
- 2024-04-03 MEDIUM: Sensitive Information Exposure (up to 3.2.9). CVE-2024-2302, https://www.wordfence.com/threat-intel/vulnerabilities/id/0837ba20-4b47-4cc8-9eb3-322289513d79?source=api-prod
- 2024-02-02 MEDIUM: Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options (up to 3.2.6). CVE-2024-0659, https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec207cd-cae5-4950-bbc8-d28f108b4ae7?source=api-prod
- 2023-12-27 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.5). CVE-2023-51684, https://www.wordfence.com/threat-intel/vulnerabilities/id/d19a9c96-918f-4f19-82a9-badd5765cea3?source=api-prod
- 2023-12-26 MEDIUM: Missing Authorization (up to 3.1.5). CVE-2023-40005, https://www.wordfence.com/threat-intel/vulnerabilities/id/dbce48b2-aa7c-4c92-8df8-ee3a17336e97?source=api-prod
- 2023-06-07 MEDIUM: Cross-Site Request Forgery via edd_trigger_upgrades (before 3.1.2). WF-e3adcb85-efc5-429c-8a06-9bfb472d668f, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3adcb85-efc5-429c-8a06-9bfb472d668f?source=api-prod
- 2023-05-02 CRITICAL: Unauthenticated Arbitrary Password Reset to Privilege Escalation (3.1 to 3.1.1.4.2 (excl.)). CVE-2023-30869, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3e07c8-8fd0-4966-8276-aece794b75b2?source=api-prod
- 2023-01-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.1.0.4). CVE-2023-0380, https://www.wordfence.com/threat-intel/vulnerabilities/id/da94a7dc-f666-44fd-9f76-e610cbd2b610?source=api-prod
- 2023-01-12 CRITICAL: SQL Injection (up to 3.1.0.3). CVE-2023-23489, https://www.wordfence.com/threat-intel/vulnerabilities/id/508b6466-2786-4d6b-9ab2-772050af4803?source=api-prod
- 2022-10-17 HIGH: Cross-Site Request Forgery to Arbitrary Post Deletion (up to 2.11.7). CVE-2022-2387, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea99795f-45fa-4d4c-a6bd-2197b58efcb2?source=api-prod
- 2022-09-28 HIGH: Unauthenticated CSV Injection (up to 3.1.0.1.1). CVE-2022-3600, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4966f96-713c-471f-8f36-55977a547f12?source=api-prod
- 2022-08-10 CRITICAL: PHP Object Injection (up to 3.0.1). CVE-2022-33900, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e563e1-5381-4353-aa09-b09971b830c8?source=api-prod
- 2022-04-09 HIGH: Cross-Site Request Forgery (before 2.11.6). CVE-2022-0707, https://www.wordfence.com/threat-intel/vulnerabilities/id/14ad420b-df09-48de-8e36-d8edf0647837?source=api-prod
- 2022-03-28 MEDIUM: Admin+ Cross-Site Scripting (before 2.11.6). CVE-2022-0706, https://www.wordfence.com/threat-intel/vulnerabilities/id/301d273e-5cd2-49b8-b2ce-b30731ab4550?source=api-prod
- 2021-10-21 MEDIUM: Reflected Cross-Site Scripting (up to 2.11.2). CVE-2021-39354, https://www.wordfence.com/threat-intel/vulnerabilities/id/56a362f3-dc4e-454d-9d94-9f4cb540d4b5?source=api-prod
- 2021-10-19 MEDIUM: Reflected Cross-Site Scripting (up to 2.11.2). WF-670e92d6-4136-48f1-88d1-69a9fa772a65, https://www.wordfence.com/threat-intel/vulnerabilities/id/670e92d6-4136-48f1-88d1-69a9fa772a65?source=api-prod
- 2021-05-04 MEDIUM: Reflected Cross-Site Scripting (up to 2.10.3). WF-a0aa2a10-da05-41e4-bbfa-938341919b5d, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0aa2a10-da05-41e4-bbfa-938341919b5d?source=api-prod
- 2021-04-16 MEDIUM: Cross-Site Request Forgery (up to 2.10.2). WF-0a6b87a8-2ebf-4db6-bf09-e9642708b2aa, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6b87a8-2ebf-4db6-bf09-e9642708b2aa?source=api-prod
- 2021-04-14 MEDIUM: Cross-Site Request Forgery (before 2.10.3). WF-b5226241-dbf4-42e5-b9f4-77da125fa810, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5226241-dbf4-42e5-b9f4-77da125fa810?source=api-prod
- 2020-09-22 CRITICAL: SQL Injection (up to 2.3.2). CVE-2015-9324, https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6a4c5f-7a02-4c53-a0ba-a2c7f592a3a8?source=api-prod
- 2019-06-12 MEDIUM: Stored Cross-Site Scripting (before 2.9.16). CVE-2019-15116, https://www.wordfence.com/threat-intel/vulnerabilities/id/82259b54-0313-41a2-ace4-41e583b93e8a?source=api-prod
- 2016-03-02 CRITICAL: PHP Object Injection (up to 2.5.7). WF-b4cd5c42-bba2-4900-b450-a575c0007402, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cd5c42-bba2-4900-b450-a575c0007402?source=api-prod
- 2015-04-20 MEDIUM: Cross-Site Scripting (6 branches affected, highest affected 2.3.6). CVE-2015-9512, https://www.wordfence.com/threat-intel/vulnerabilities/id/456f038c-85a4-426e-b9e0-3acf91f9b93a?source=api-prod
- 2015-04-20 MEDIUM: Cross-Site Scripting (6 branches affected, highest affected 2.3.7). CVE-2015-9505, https://www.wordfence.com/threat-intel/vulnerabilities/id/be60027e-9d6a-4740-b20c-6be3e115d9fe?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=easy-digital-downloads · HTML: https://todaywp.com/plugins/easy-digital-downloads