smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

• CVE-2026-120538 High 8.1 Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture 0.4%
• CVE-2026-14335 High 7.2 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters 0.2%
• CVE-2026-12476 High 7.2 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter 1.2%
• CVE-2026-7533 Medium 4.3 Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter 0.1%
• CVE-2025-14783 Medium 4.3 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect 0.3%
• CVE-2025-11271 Medium 5.3 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation 0.3%
• CVE-2025-8102 Medium 5.4 Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions 0.2%
• CVE-2025-4670 Medium 6.4 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode 0.4%
• CVE-2025-2252 Medium 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure 0.4%
• CVE-2024-13517 Medium 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title 0.2%
• CVE-2024-12875 Medium 4.9 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download 1.0%
• CVE-2024-9654 Low 3.7 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass 0.4%
• CVE-2022-2439 High 7.2 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization 0.7%
• CVE-2024-6692 Low 3.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text 0.4%
• CVE-2024-6691 Medium 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings 0.4%
• CVE-2024-2302 Medium 5.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure 0.6%
• CVE-2024-0659 Medium 5.5 Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options 0.4%