Advisories · Technology
smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy.
Every CVE that names smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Authentication bypass
- CVSS 7.2 High
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 7.2 High
Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Unrestricted file upload
- CVSS 4.3 Medium
Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CWE-640
- CVSS 5.3 Medium
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CWE-807
- CVSS 5.4 Medium
Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site request forgery (CSRF)
- CVSS 6.4 Medium
Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Information disclosure
- CVSS 4.4 Medium
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Path traversal
- CVSS 3.7 Low
Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Broken access control
- CVSS 7.2 High
Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Insecure deserialization
- CVSS 3.3 Low
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Information disclosure
- CVSS 5.5 Medium
Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)