What’s Vulnerable › Products

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerabilities

66 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy version is affected

Latest smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy vulnerabilities

• CVE-2026-116403 — WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability (CVSS 5.9)
• CVE-2026-14335 — Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters (CVSS 7.2)
• CVE-2026-42638 — WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-95522 — WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability (CVSS 7.6)
• CVE-2026-12476 — Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter (CVSS 7.2)
• CVE-2026-66476 — WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability (CVSS 4.9)
• CVE-2026-39503 — WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-7533 — Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter (CVSS 4.3)
• CVE-2025-14783 — Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect (CVSS 4.3)
• CVE-2025-11271 — Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation (CVSS 5.3)
• CVE-2025-8102 — Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions (CVSS 5.4)
• CVE-2025-4670 — Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode (CVSS 5.4)
• CVE-2025-2252 — Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure (CVSS 5.3)
• CVE-2024-13517 — Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title (CVSS 4.0)
• CVE-2024-12875 — Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download (CVSS 4.9)
• CVE-2024-9654 — Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass (CVSS 3.7)
• CVE-2023-40005 — WordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access Control (CVSS 9.8)
• CVE-2024-43162 — WordPress Easy Digital Downloads plugin <= 3.2.12 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2022-2439 — Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2)
• CVE-2024-5057 — WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability (CVSS 9.8)
• CVE-2024-6692 — Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text (CVSS 3.1)
• CVE-2024-6691 — Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings (CVSS 4.0)
• CVE-2024-2302 — Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure (CVSS 5.3)
• CVE-2024-0659 — Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options (CVSS 4.8)
• CVE-2023-51684 — WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)