WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

The #1 eCommerce plugin to sell digital products & subscriptions. Accept payments with Stripe & PayPal. Sell ebooks, software & more.

74Reported vulnerabilities
10Highest CVSS score
3.7.0Latest version
40,000+Active installs

What to do now

Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to 3.6.9.1 or later. 74 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-23489 Critical 9.8 11.2% Before 3.1.0.4 3.1.0.4 January 20, 2023
CVE-2022-3600 Critical 9.8 1.2% Before 3.1.0.2 3.1.0.2 November 21, 2022
CVE-2024-5057 Critical 10 2.6% 3.2.12 and earlier 3.3.1 August 1, 2024
CVE-2023-30869 Critical 9.8 3.1% 3.1 up to (but not including) 3.1.1.4.2 3.1.1.4.2 May 2, 2023
CVE-2015-9324 Critical 9.8 2.0% Before 2.3.3 2.3.3 August 16, 2019
WF-b4cd5c42-bba2-4900-b450-a575c0007402 Critical 9.8 — 2.5.7 and earlier 2.5.8 March 2, 2016
CVE-2023-0380 Medium 5.4 0.5% Before 3.1.0.5 3.1.0.5 February 21, 2023
CVE-2021-39354 Medium 4.8 0.9% 2.11.2 and earlier 2.11.2.1 October 21, 2021
CVE-2022-0706 Medium 4.8 0.7% Before 2.11.6 2.11.6 April 18, 2022
CVE-2022-2387 Medium 4.3 0.3% Before 3.0 3.0 November 7, 2022
CVE-2022-0707 Medium 4.3 0.5% Before 2.11.6 2.11.6 April 18, 2022
CVE-2022-33900 High 7.2 0.9% 3.0.1 and earlier 3.0.2 August 22, 2022
CVE-2026-12476 High 7.2 0.6% 0 to 3.6.9 (inclusive) 3.6.9.1 July 29, 2026
CVE-2022-2439 High 7.2 0.7% Before 3.3.4 3.3.4 September 24, 2024
CVE-2026-66476 Medium 6.5 0.3% 3.6.9 and earlier 3.6.9.1 July 27, 2026
CVE-2023-51684 Medium 6.4 0.3% 3.2.5 and earlier 3.2.6 December 27, 2023
CVE-2015-9524 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9523 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9522 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9521 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9520 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9519 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9518 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9517 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9516 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9515 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9514 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9513 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9512 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9511 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9510 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9509 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9508 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9507 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9506 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9505 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9536 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9535 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9534 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9533 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9532 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9531 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9530 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9529 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9528 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9527 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9526 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2015-9525 Medium 6.1 0.9% 1.8 up to (but not including) 1.8.7
1.9 up to (but not including) 1.9.10
2.0 up to (but not including) 2.0.5
2.1 up to (but not including) 2.1.11
2.2 up to (but not including) 2.2.9
2.3 up to (but not including) 2.3.7		 1.8.7 October 23, 2019
CVE-2019-15116 Medium 6.1 1.0% Before 2.9.16 2.9.16 August 16, 2019
WF-a0aa2a10-da05-41e4-bbfa-938341919b5d Medium 6.1 — 2.10.3 and earlier 2.10.4 May 4, 2021
CVE-2025-4670 Medium 5.4 0.3% Before 3.3.9 3.3.9 May 29, 2025
CVE-2024-32100 Medium 5.3 0.6% 3.2.11 and earlier 3.2.12 May 9, 2024
CVE-2024-2302 Medium 5.3 0.6% Before 3.2.10 3.2.10 April 9, 2024
CVE-2023-40005 Medium 5.3 0.6% 3.1.5 and earlier 3.2.0 December 26, 2023
CVE-2026-59524 Medium 5.3 0.4% 3.6.7 and earlier 3.6.8 July 22, 2026
CVE-2026-39503 Medium 5.3 0.2% 3.6.5 and earlier 3.6.6 April 20, 2026
CVE-2025-11271 Medium 5.3 0.3% 3.5.2 and earlier 3.5.3 November 5, 2025
CVE-2025-8102 Medium 5.4 0.2% 0 to 3.5.0 (inclusive) 3.5.1 August 20, 2025
CVE-2025-2252 Medium 5.3 0.4% Before 3.3.7 3.3.7 March 25, 2025
WF-670e92d6-4136-48f1-88d1-69a9fa772a65 Medium 5.4 — 2.11.2 and earlier 2.11.2.1 October 19, 2021
CVE-2024-12875 Medium 4.9 1.0% Before 3.3.3 3.3.3 December 21, 2024
CVE-2024-0659 Medium 4.8 0.4% 3.2.6 and earlier 3.2.7 February 5, 2024
CVE-2026-7533 Medium 4.3 0.1% 0 to 3.6.7 (inclusive) 3.6.8 May 28, 2026
CVE-2025-14783 Medium 4.3 0.4% 0 to 3.6.2 (inclusive) 3.6.3 December 31, 2025
CVE-2024-43162 Medium 4.3 0.5% 3.2.12 and earlier 3.3.1 August 7, 2024
CVE-2024-31113 Medium 4.3 0.2% 3.2.11 and earlier 3.2.12 May 9, 2024
CVE-2024-31293 Medium 4.3 0.2% 3.2.6 and earlier 3.2.7 April 5, 2024
WF-e3adcb85-efc5-429c-8a06-9bfb472d668f Medium 4.3 — Before 3.1.2 3.1.2 June 7, 2023
WF-0a6b87a8-2ebf-4db6-bf09-e9642708b2aa Medium 4.3 — 2.10.2 and earlier 2.10.3 April 16, 2021
WF-b5226241-dbf4-42e5-b9f4-77da125fa810 Medium 4.3 — Before 2.10.3 2.10.3 April 14, 2021
CVE-2024-6691 Medium 4 0.4% Before 3.3.3 3.3.3 August 12, 2024
CVE-2024-13517 Medium 4 0.2% Before 3.3.3 3.3.3 January 18, 2025
CVE-2024-9654 Low 3.7 0.3% 3.1 up to (but not including) 3.3.5 3.3.5 December 17, 2024
CVE-2024-6692 Low 3.1 0.4% Before 3.3.3 3.3.3 August 12, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.