sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total75
Critical6
High6
Medium61
Reset
Showing 1-20 of 75 records
Threat Entry Updated 2026-11-08

Easy Digital Downloads - Security Vulnerability (CVE-2026-120538)

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled…

PLUGIN Easy Digital Downloads

CVE-2026-120538

HIGH CVSS 8.1 2026-11-03
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

Easy Digital Downloads - Security Vulnerability (CVE-2026-116403)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

PLUGIN Easy Digital Downloads

CVE-2026-116403

MEDIUM CVSS 5.9 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Easy Digital Downloads - Security Vulnerability (CVE-2026-14335)

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Easy Digital Downloads

CVE-2026-14335

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-08

Easy Digital Downloads - Security Vulnerability (CVE-2026-105190)

The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.

PLUGIN Easy Digital Downloads

CVE-2026-105190

MEDIUM CVSS 5.3 2026-10-08
Open Full Technical Breakdown
Threat Entry Updated 2026-10-08

Easy Digital Downloads - Security Vulnerability (CVE-2026-105194)

The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.

PLUGIN Easy Digital Downloads

CVE-2026-105194

MEDIUM CVSS 4.3 2026-10-08
Open Full Technical Breakdown
Threat Entry Updated 2026-07-30

Easy Digital Downloads - Remote Code Execution (CVE-2026-12476)

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected…

PLUGIN Easy Digital Downloads

CVE-2026-12476

HIGH CVSS 7.2 2026-07-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Request Forgery (CSRF) (CVE-2026-7533)

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

PLUGIN Easy Digital Downloads

CVE-2026-7533

MEDIUM CVSS 4.3 2026-05-28
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Open Redirect (CVE-2025-14783)

The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.

PLUGIN Easy Digital Downloads

CVE-2025-14783

MEDIUM CVSS 4.3 2025-12-31
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Security Vulnerability (CVE-2025-11271)

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer…

PLUGIN Easy Digital Downloads

CVE-2025-11271

MEDIUM CVSS 5.3 2025-11-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Request Forgery (CSRF) (CVE-2025-8102)

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Easy Digital Downloads

CVE-2025-8102

MEDIUM CVSS 5.4 2025-08-20
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2025-4670)

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Easy Digital Downloads

CVE-2025-4670

MEDIUM CVSS 6.4 2025-05-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Information Disclosure (CVE-2025-2252)

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.

PLUGIN Easy Digital Downloads

CVE-2025-2252

MEDIUM CVSS 5.3 2025-03-25
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2024-13517)

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

PLUGIN Easy Digital Downloads

CVE-2024-13517

MEDIUM CVSS 4.4 2025-01-18
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Path Traversal (CVE-2024-12875)

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

PLUGIN Easy Digital Downloads

CVE-2024-12875

MEDIUM CVSS 4.9 2024-12-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Security Vulnerability (CVE-2024-9654)

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they…

PLUGIN Easy Digital Downloads

CVE-2024-9654

LOW CVSS 3.7 2024-12-17
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.