High
CVE-2026-14335
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 51
Reset filters
Medium
CVE-2026-105194
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-42638
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization
Medium
CVE-2026-95522
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection
High
CVE-2026-12476
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Medium
CVE-2026-66476
Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion
Medium
CVE-2026-59524
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization
Medium
CVE-2026-7533
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
Medium
CVE-2026-39503
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization
Medium
CVE-2025-14783
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
Medium
CVE-2025-11271
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
Medium
CVE-2025-8102
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
Medium
CVE-2025-4670
Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
Medium
CVE-2025-2252
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
Medium
CVE-2023-2334
Easy Digital Downloads Google Sheet Connector <= 1.6.6 - Cross-Site Request Forgery to Access Code Update
Medium
CVE-2024-13517
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title
Medium
CVE-2024-12875
Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download
Low
CVE-2024-9654
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
Medium
CVE-2024-51836
Wezido <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2022-2439
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
Low
CVE-2024-6692
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
Medium
CVE-2024-6691
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
Medium
CVE-2024-43162
Easy Digital Downloads <= 3.2.12 - Missing Authorization
Critical
CVE-2024-5057
Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.