Unknown Easy Digital Downloads vulnerabilities
4 vulnerabilities
Known vulnerabilities in Unknown Easy Digital Downloads, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2022-3600awesomemotive · easy_digital_downloads +2 moreEasy Digital Downloads < 3.1.0.2 - Unauthenticated CSV InjectionThe Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.EPSS1.31%MediumCVE-2026-105194unknown · easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads BlockThe Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.EPSS0.21%MediumCVE-2026-105190unknown · easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration DisabledThe Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.EPSS0.18%MediumCVE-2023-0380sandhillsdev · easy_digital_downloads +2 moreEasy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSSThe Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.EPSS0.46%