WordPress easy-digital-downloads has 47 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-23489 | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th | critical | 9.8 | <3.1.0.4 | 3.1.0.4 |
| CVE-2015-9324 | The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. | critical | 9.8 | <2.3.3 | 2.3.3 |
| CVE-2022-3600 | The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV inj | critical | 9.8 | <3.1.0.2 | 3.1.0.2 |
| CVE-2024-12875 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all | medium | 4.9 | <3.3.3 | 3.3.3 |
| CVE-2019-15116 | The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. | medium | 6.1 | <2.9.16 | 2.9.16 |
| CVE-2021-39354 | The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters fou | medium | 4.8 | <=2.11.2 | – |
| CVE-2015-9505 | The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befo | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9506 | The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9507 | The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9508 | The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9509 | The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0. | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9510 | The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9511 | The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1. | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9512 | The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9513 | The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9514 | The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x bef | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9515 | The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9516 | The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2. | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9517 | The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9518 | The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x befor | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9519 | The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9520 | The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9521 | The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9522 | The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9523 | The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9524 | The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9525 | The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9526 | The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9527 | The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9528 | The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9529 | The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0. | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9530 | The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2015-9531 | The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before | medium | 6.1 | >=1.8 and <1.8.7 or >=1.9 and <1.9.10 or >=2.0 and <2.0.5 or >=2.1 and <2.1.11 or >=2.2 and <2.2.9 or >=2.3 and <2.3.7 | 1.8.7, 1.9.10, 2.0.5, 2.1.11 |
| CVE-2022-33900 | PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress. | medium | 4.1 | <=3.0.1 | – |
| CVE-2022-2439 | The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted i | high | 7.2 | <3.3.4 | 3.3.4 |
| CVE-2022-0706 | The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could a | medium | 4.8 | <2.11.6 | 2.11.6 |
| CVE-2024-2302 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 5.3 | <3.2.10 | 3.2.10 |
| CVE-2022-0707 | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow | medium | 4.3 | <2.11.6 | 2.11.6 |
| CVE-2023-0380 | The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them bac | medium | 5.4 | <3.1.0.5 | 3.1.0.5 |
| CVE-2024-0659 | The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Si | medium | 5.5 | <=3.2.6 | – |
| CVE-2025-2252 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Expo | medium | 5.3 | <3.3.7 | 3.3.7 |
| CVE-2024-6692 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | low | 3.3 | <3.3.3 | 3.3.3 |
| CVE-2025-4670 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 6.4 | <3.3.9 | 3.3.9 |
| CVE-2024-9654 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack | low | 3.7 | >=3.1 and <3.3.5 | 3.3.5 |
| CVE-2024-6691 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to | medium | 4.4 | <3.3.3 | 3.3.3 |
| CVE-2022-2387 | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure | medium | 4.3 | <3.0 | 3.0 |
| CVE-2024-13517 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.4 | <3.3.3 | 3.3.3 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked