sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total75
Critical6
High6
Medium61
Reset
Showing 21-40 of 75 records
Threat Entry Updated 2026-06-17

Easy Digital Downloads - PHP Object Injection (CVE-2022-2439)

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

PLUGIN Easy Digital Downloads

CVE-2022-2439

HIGH CVSS 7.2 2024-09-24
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - SQL Injection (CVE-2024-5057)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

PLUGIN Easy Digital Downloads

CVE-2024-5057

CRITICAL CVSS 9.3 2024-08-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2024-6691)

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

PLUGIN Easy Digital Downloads

CVE-2024-6691

MEDIUM CVSS 4.4 2024-08-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2024-6692)

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

PLUGIN Easy Digital Downloads

CVE-2024-6692

LOW CVSS 3.3 2024-08-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Path Traversal (CVE-2024-35629)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.

PLUGIN Easy Digital Downloads

CVE-2024-35629

CRITICAL CVSS 9.6 2024-06-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Information Disclosure (CVE-2024-2302)

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.

PLUGIN Easy Digital Downloads

CVE-2024-2302

MEDIUM CVSS 5.3 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2024-0659)

The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Easy Digital Downloads

CVE-2024-0659

MEDIUM CVSS 5.5 2024-02-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2023-51684)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.

PLUGIN Easy Digital Downloads

CVE-2023-51684

MEDIUM CVSS 6.5 2024-02-01
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Scripting (XSS) (CVE-2023-0380)

The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Easy Digital Downloads

CVE-2023-0380

MEDIUM CVSS 5.4 2023-02-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Easy Digital Downloads - Cross-Site Request Forgery (CSRF) (CVE-2022-2387)

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack

PLUGIN Easy Digital Downloads

CVE-2022-2387

MEDIUM CVSS 4.3 2022-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.