WP Security CheckVulnerability data as of October 22, 2026

Known vulnerabilities in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

The #1 eCommerce plugin to sell digital products & subscriptions. Accept payments with Stripe & PayPal. Sell ebooks, software & more.

49Reported vulnerabilities
10Highest CVSS score
3.7.0Latest version
40,000+Active installs

What to do now

Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to 3.6.9.1 or later. 49 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-23489 Critical 9.8 11.2% Before 3.1.0.4 3.1.0.4 January 20, 2023
CVE-2022-3600 Critical 9.8 1.3% Before 3.1.0.2 3.1.0.2 November 21, 2022
CVE-2024-5057 Critical 10 2.6% 3.2.12 and earlier 3.3.1 August 1, 2024
CVE-2023-30869 Critical 9.8 3.1% 3.1 up to (but not including) 3.1.1.4.2 3.1.1.4.2 May 2, 2023
CVE-2015-9324 Critical 9.8 2.0% Before 2.3.3 2.3.3 August 16, 2019
WF-b4cd5c42-bba2-4900-b450-a575c0007402 Critical 9.8 — 2.5.7 and earlier 2.5.8 March 2, 2016
CVE-2023-0380 Medium 5.4 0.5% Before 3.1.0.5 3.1.0.5 February 21, 2023
CVE-2021-39354 Medium 4.8 0.9% 2.11.2 and earlier 2.11.2.1 October 21, 2021
CVE-2022-0706 Medium 4.8 0.7% Before 2.11.6 2.11.6 April 18, 2022
CVE-2022-2387 Medium 4.3 0.3% Before 3.0 3.0 November 7, 2022
CVE-2022-0707 Medium 4.3 0.5% Before 2.11.6 2.11.6 April 18, 2022
CVE-2026-12476 High 7.2 1.2% 0 to 3.6.9 (inclusive) 3.6.9.1 July 29, 2026
CVE-2022-33900 High 7.2 0.9% 3.0.1 and earlier 3.0.2 August 22, 2022
CVE-2022-2439 High 7.2 0.7% Before 3.3.4 3.3.4 September 24, 2024
CVE-2026-14335 High 7.2 0.2% 0 to 3.6.9 (inclusive) 3.6.9.1 October 10, 2026
CVE-2026-66476 Medium 6.5 0.5% 3.6.9 and earlier 3.6.9.1 July 27, 2026
CVE-2023-51684 Medium 6.4 0.3% 3.2.5 and earlier 3.2.6 December 27, 2023
CVE-2015-9512 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9505 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2019-15116 Medium 6.1 1.0% Before 2.9.16 2.9.16 August 16, 2019
WF-a0aa2a10-da05-41e4-bbfa-938341919b5d Medium 6.1 — 2.10.3 and earlier 2.10.4 May 4, 2021
CVE-2025-4670 Medium 5.4 0.3% Before 3.3.9 3.3.9 May 29, 2025
CVE-2024-32100 Medium 5.3 0.6% 3.2.11 and earlier 3.2.12 May 9, 2024
CVE-2024-2302 Medium 5.3 0.6% Before 3.2.10 3.2.10 April 9, 2024
CVE-2023-40005 Medium 5.3 0.6% 3.1.5 and earlier 3.2.0 December 26, 2023
CVE-2026-105190 Medium 5.3 0.2% 0 up to (but not including) 3.7.1 3.7.1 October 8, 2026
CVE-2026-42638 Medium 5.3 0.3% 3.7.1 and earlier 3.7.1.1 October 5, 2026
CVE-2026-59524 Medium 5.3 0.4% 3.6.7 and earlier 3.6.8 July 22, 2026
CVE-2026-39503 Medium 5.3 0.3% 3.6.5 and earlier 3.6.6 April 20, 2026
CVE-2025-11271 Medium 5.3 0.3% 3.5.2 and earlier 3.5.3 November 5, 2025
CVE-2025-8102 Medium 5.4 0.2% 0 to 3.5.0 (inclusive) 3.5.1 August 20, 2025
CVE-2025-2252 Medium 5.3 0.4% Before 3.3.7 3.3.7 March 25, 2025
WF-670e92d6-4136-48f1-88d1-69a9fa772a65 Medium 5.4 — 2.11.2 and earlier 2.11.2.1 October 19, 2021
CVE-2024-12875 Medium 4.9 1.0% Before 3.3.3 3.3.3 December 21, 2024
CVE-2026-95522 Medium 4.9 0.3% 3.7.0 and earlier 3.7.1 September 23, 2026
CVE-2024-0659 Medium 4.8 0.4% 3.2.6 and earlier 3.2.7 February 5, 2024
CVE-2026-105194 Medium 4.3 0.2% Before 3.7.1 3.7.1 October 8, 2026
CVE-2026-7533 Medium 4.3 0.2% 0 to 3.6.7 (inclusive) 3.6.8 May 28, 2026
CVE-2025-14783 Medium 4.3 0.3% 0 to 3.6.2 (inclusive) 3.6.3 December 31, 2025
CVE-2024-43162 Medium 4.3 0.5% 3.2.12 and earlier 3.3.1 August 7, 2024
CVE-2024-31113 Medium 4.3 0.2% 3.2.11 and earlier 3.2.12 May 9, 2024
CVE-2024-31293 Medium 4.3 0.2% 3.2.6 and earlier 3.2.7 April 5, 2024
WF-e3adcb85-efc5-429c-8a06-9bfb472d668f Medium 4.3 — Before 3.1.2 3.1.2 June 7, 2023
WF-0a6b87a8-2ebf-4db6-bf09-e9642708b2aa Medium 4.3 — 2.10.2 and earlier 2.10.3 April 16, 2021
WF-b5226241-dbf4-42e5-b9f4-77da125fa810 Medium 4.3 — Before 2.10.3 2.10.3 April 14, 2021
CVE-2024-6691 Medium 4 0.4% Before 3.3.3 3.3.3 August 12, 2024
CVE-2024-13517 Medium 4 0.2% Before 3.3.3 3.3.3 January 18, 2025
CVE-2024-9654 Low 3.7 0.4% 3.1 up to (but not including) 3.3.5 3.3.5 December 17, 2024
CVE-2024-6692 Low 3.1 0.4% Before 3.3.3 3.3.3 August 12, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.