Skip to content
Threat Feed
Subscribe

Vendor

Easy Digital Downloads

3 briefs RSS
high advisory

Easy Digital Downloads: Authentication bypass in PayPal checkout (CVE-2026-120538)

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

Easy Digital Downloads wordpress vulnerability authentication-bypass
2t 1c
high advisory

Stored Cross-Site Scripting Vulnerability in Easy Digital Downloads Plugin

An unauthenticated stored XSS vulnerability in the Easy Digital Downloads WordPress plugin allows attackers to inject malicious scripts via PayPal IPN parameters.

Easy Digital Downloads wordpress xss web-application cve-2026-14335
1t 1c
high advisory

Easy Digital Downloads Plugin Arbitrary File Upload Leads to RCE (CVE-2026-12476)

The Easy Digital Downloads plugin for WordPress versions up to and including 3.6.9 is vulnerable to Arbitrary File Upload (CVE-2026-12476) due to insufficient file type validation, allowing authenticated attackers with Shop Manager-level access or higher to upload arbitrary files which can lead to remote code execution.

Easy Digital Downloads plugin web arbitrary-file-upload rce wordpress plugin
1r 3t 1c