¿Es seguro Easy Digital Downloads?

Qué hace este plugin

• Slug: easy-digital-downloads
• 40000+ instalaciones activas

digital storeecommercepaymentssell digital productsstripe

Estado de mantenimiento

• Última versión conocida: 3.6.9
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

65 CVEs conocidos registrados para Easy Digital Downloads.

CVE-2026-7533

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing nonce verification in the `handle_oauth_redirect()` function, which is registered on the `admin_init` hook and processes Square OAuth tokens from a user-supplied GET parameter without any CSRF token validation. This makes it possible for unauthenticated attackers to overwrite the store's Square payment gateway credentials by tricking a logged-in administrator into clicking a crafted link, potentially resulting in payment account hijacking.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-39503

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.6.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-14783

The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-11271

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=1. Because this value is attacker-supplied, an unauthenticated actor can submit a forged IPN and have it treated as verified, even on production sites and with verification otherwise enabled. A valid PayPal transaction id is needed, restricting order manipulation to orders placed by the attacker. This, in turn, requires them to have a customer account.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13517

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-12875

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-2439

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6691

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 71 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-6692	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.3.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Baja 3,1	< 3.3.3	3.3.3	2024-08-09	✓ corregido en la última versión
CVE-2024-43162	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.3.1	Falta de control de autorización	Alta 8,8	< 3.3.1	3.3.1	2024-08-07	✓ corregido en la última versión
CVE-2024-5057	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.3.1	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 3.3.1	3.3.1	2024-08-01	✓ corregido en la última versión
CVE-2024-31113	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.12	Falsificación de petición en sitios cruzados (CSRF)	Alta 8,8	< 3.2.12	3.2.12	2024-05-09	✓ corregido en la última versión
CVE-2024-32100	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.12	Exposición de información sensible a un actor no autorizado	Alta 7,5	< 3.2.12	3.2.12	2024-05-09	✓ corregido en la última versión
CVE-2024-31293	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.7	Falsificación de petición en sitios cruzados (CSRF)	Alta 8,8	< 3.2.7	3.2.7	2024-04-05	✓ corregido en la última versión
CVE-2024-2302	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.10	Inserción de información sensible en un archivo de registro (log)	Media 5,3	< 3.2.10	3.2.10	2024-04-03	✓ corregido en la última versión
CVE-2024-0659	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.2.7	3.2.7	2024-02-02	✓ corregido en la última versión
CVE-2023-51684	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 3.2.6	3.2.6	2023-12-27	✓ corregido en la última versión
CVE-2023-40005	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.2.0	Falta de control de autorización	Media 5,3	< 3.2.0	3.2.0	2023-12-26	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.2	—	Desconocido	< 3.1.2	3.1.2	2023-06-08	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.2	—	Desconocido	< 3.1.2	3.1.2	2023-06-07	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] >= 3.1 - <= 3.1.1.4.1	—	Desconocido	3.1–3.1.1.4.1	3.1.1.4.1	2023-05-02	✓ corregido en la última versión
CVE-2023-30869	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] >= 3.1 - <= 3.1.1.4.1	Autenticación indebida	Crítica 9,8	3.1–3.1.1.4.1	3.1.1.4.1	2023-05-01	✓ corregido en la última versión
CVE-2023-0380	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.0.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.1.0.5	3.1.0.5	2023-01-30	✓ corregido en la última versión
CVE-2023-23489	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.0.4	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 3.1.0.4	3.1.0.4	2023-01-12	✓ corregido en la última versión
CVE-2022-2387	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.0	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 3.0	3.0	2022-10-17	✓ corregido en la última versión
CVE-2022-3600	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.0.2	Neutralización incorrecta de elementos de fórmula en un archivo CSV (CSV Injection)	Crítica 9,8	< 3.1.0.2	3.1.0.2	2022-09-28	✓ corregido en la última versión
CVE-2022-33900	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.1.4.2	Neutralización incorrecta de elementos especiales en la salida usada por un componente posterior (inyección)	Media 4,1	< 3.1.1.4.2	3.1.1.4.2	2022-08-10	✓ corregido en la última versión
CVE-2022-0707	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.6	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 2.11.6	2.11.6	2022-03-28	✓ corregido en la última versión
CVE-2022-0706	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 2.11.6	2.11.6	2022-03-28	✓ corregido en la última versión
CVE-2021-39354	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.2.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 2.11.2.1	2.11.2.1	2021-10-21	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.2.1	—	Desconocido	< 2.11.2.1	2.11.2.1	2021-10-19	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.4	—	Desconocido	< 2.10.4	2.10.4	2021-05-04	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3	—	Desconocido	< 2.10.3	2.10.3	2021-04-16	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3	—	Desconocido	< 2.10.3	2.10.3	2021-04-16	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3	—	Desconocido	< 2.10.3	2.10.3	2021-04-14	✓ corregido en la última versión
CVE-2015-9517	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9518	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9510	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9526	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9528	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9530	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9531	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9516	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9535	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9521	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9534	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9525	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-23	✓ corregido en la última versión
CVE-2015-9508	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2019-10-14	✓ corregido en la última versión
CVE-2015-9324	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.3	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 2.3.3	2.3.3	2019-08-16	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.9.16	—	Desconocido	< 2.9.16	2.9.16	2019-06-16	✓ corregido en la última versión
CVE-2019-15116	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.9.16	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.9.16	2.9.16	2019-06-12	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.8	—	Desconocido	< 2.8	2.8	2017-03-31	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8	—	Desconocido	< 2.5.8	2.5.8	2016-03-02	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8	—	Desconocido	< 2.5.8	2.5.8	2016-03-02	✓ corregido en la última versión
CVE-2015-9506	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9507	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9509	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9511	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9505	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9512	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9513	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9515	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9533	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9519	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9520	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9514	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9522	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9524	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9523	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9527	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9529	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9532	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2015-9536	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.3.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.3.7	2.3.7	2015-04-20	✓ corregido en la última versión
CVE-2024-9654	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] >= 3.1 - <= 3.3.4	Autorización incorrecta	Baja 3,7	3.1–3.3.4	3.3.4	0000-00-00	✓ corregido en la última versión
CVE-2025-2252	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.3.7	Exposición de información sensible a un actor no autorizado	Media 5,3	< 3.3.7	3.3.7	0000-00-00	✓ corregido en la última versión
CVE-2025-4670	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.3.9	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 3.3.9	3.3.9	0000-00-00	✓ corregido en la última versión
CVE-2025-8102	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.5.1	Falsificación de petición en sitios cruzados (CSRF)	Media 5,4	< 3.5.1	3.5.1	0000-00-00	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3	—	Desconocido	< 2.10.3	2.10.3	—	✓ corregido en la última versión
—	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8	—	Desconocido	< 2.5.8	2.5.8	—	✓ corregido en la última versión

CVE-2024-6692

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-43162

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5057

The Easy Digital Downloads plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-31113

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.11. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-32100

The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.11. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-31293

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.2.7). Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.2.7. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2302

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.2.10). Colin Xu discovered and reported this Sensitive Data Exposure vulnerability in WordPress Easy Digital Downloads Plugin. This vulnerability has been fixed in version 3.2.10. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-0659

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.2.7). emad discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.7. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-51684

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.2.6). LVT-tholv2k discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.6. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-40005

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.2.0). Nguyen Anh Tien discovered and reported this Broken Access Control vulnerability in WordPress Easy Digital Downloads Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.2.0. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.2

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.1.2). An unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.1.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.1.2

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1.4.2. This is due to missing or incorrect nonce validation on the edd_trigger_upgrades function. This makes it possible for unauthenticated attackers to trigger plugin upgrades via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] >= 3.1 - <= 3.1.1.4.1

The Easy Digital Downloads plugin for WordPress is vulnerable to Unauthenticated Arbitrary Password Resets to Privilege Escalation in versions 3.1 to 3.1.1.4.1. This is due to a lack of validation of a password reset key in the edd_validate_password_reset function. This makes it possible for unauthenticated attackers to reset the password of any user on a vulnerable site, including an administrator, if they have the email or username of the targeted account.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-30869

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.1.1.4.2). Nguyen Anh Tien discovered and reported this Privilege Escalation vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this they could take full control of the website if high privileges are gained. This vulnerability has been fixed in version 3.1.1.4.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-0380

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.1.0.5). Lana Codes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.1.0.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-23489

Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.1.0.4). Joshua Martinelle discovered and reported this SQL Injection vulnerability in WordPress Easy Digital Downloads Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information and creating new administrator accounts. This vulnerability has been fixed in version 3.1.0.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-2387

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.11.7 . This is due to missing or incorrect nonce validation when deleting payment history. Additionally, the plugin does not ensure that the item about to be deleted is payment history. This makes it possible for unauthenticated attackers to delete arbitrary posts, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-3600

The Easy Digital Downloads plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 3.1.0.1.1. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-33900

PHP Object Injection vulnerability was discovered by Robert Rowley (Patchstack) in the WordPress Easy Digital Downloads plugin (versions <= 3.0.1). Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.0.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-0707

The Easy Digital Downloads WordPress plugin before version 2.11.6 does not have Cross-Site Request Forgery checks in place when inserting payment notes. This could allow attackers to make a logged admin insert arbitrary notes via a Cross-Site Request Forgery attack.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0706

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-39354

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.11.2.1

The Easy Digital Downloads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start-date' and 'end-date' parameters in versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.4

The Easy Digital Downloads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘code’ parameter in versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3

Cross-Site Request Forgery (CSRF) vulnerability discovered by WPScan team in WordPress Easy Digital Downloads plugin (versions <= 2.10.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.2. This is due to missing or incorrect nonce validation on the edds_stripe_connect_process_disconnect() function. This makes it possible for unauthenticated attackers to disconnect any user signed in with the manage_options capability via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.2. This is due to missing or incorrect nonce validation on the edds_stripe_connect_process_disconnect function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9517

The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9518

The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9510

The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9526

The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9528

The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9530

The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9531

The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9516

The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9535

The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9521

The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9534

The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9525

The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9508

The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9324

The Easy Digital Downloads – Simple Ecommerce for Selling Digital Files WordPress plugin was affected by a SQL Injection security vulnerability. Versions up to, and including, 2.3.2 were affected.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.9.16

Stored Cross-Site Scripting (XSS) vulnerability found in WordPress Easy Digital Downloads plugin (versions <= 2.9.15).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2019-15116

The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.8

WordPress Easy Digital Downloads plugin in 2.7.11 and earlier versions are vulnerable to information disclosure vulnerability. The plugin function edd_ajax_get_download_title is accessible to anyone logged in or logged out users. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8

Because of this vulnerability, attackers can execute arbitrary PHP code. Upgrade the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8

The Easy Digital Downloads plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.5.7 via deserialization of untrusted input from cookies and request parameters. This allows unauthenticated attackers to inject a PHP Object.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9506

The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9507

The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9509

The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9511

The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9505

The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9512

The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9513

The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9515

The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9533

The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9519

The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9520

The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9514

The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9522

The Easy Digital Downloads (EDD) QR Code extension for WordPress in versions up to, and including, 1.1.0, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9524

The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused. The standalone extension was not patched and a patched version was instead integrated into EDD Core.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9523

The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9527

The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9529

The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9532

The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2015-9536

The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-9654

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-2252

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the edd_ajax_get_download_title() function. This makes it possible for unauthenticated attackers to extract private post titles of downloads. The impact here is minimal.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-4670

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-8102

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.10.3

The plugin did not property check for CSRF when disconnecting Stripe, allowing attackers to make logged in users with the manage_options capability disconnect the Stripe gateway via a CSRF attack.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 2.5.8

Easy Digital Downloads unserializes user-submitted data from cookies and other request parameters, allowing for object injection.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Easy Digital Downloads actualizado — 3.6.9 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WooCommerce — 7000000+ instalaciones activas — 90/100 (4808)
• Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation — 1000000+ instalaciones activas — 86/100 (813) — PHP máx. 8.4
• WooCommerce PayPal Payments — 800000+ instalaciones activas — 56/100 (567) — PHP máx. 8.4
• Mailchimp for WooCommerce — 200000+ instalaciones activas — 80/100 (725) — PHP máx. 8.4
• Download Manager — 100000+ instalaciones activas — 82/100 (1002) — PHP máx. 8.4