Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.

1. ★★★★★ alain2204

   1mo ago

   Réponse rapide et efficace

   Read on wp.org ↗
2. ★★★★★ graham49

   2mo ago

   I was struggling with some of the more complex issues within WordPress and although I struggled with the EDD AI support, when I got through to a human being the problem was solved totally and politely (I would also add with a high degree of patience!). I’m most grateful. GH

   Read on wp.org ↗
3. ★★★★★ Md. Sarwar Zaman

   2mo ago

   If you sell digital assets, EDD is the absolute best framework available. It’s built cleanly on core WordPress standards, handles complex workflows flawlessly right out of the box, and is backed by a remarkably responsive, expert support team.

   Read on wp.org ↗
4. ★★★★★ dfathers

   3mo ago

   We were experiencing issues with the Easy Digital Downloads shopping cart and contacted support for assistance. Within approximately two hours, their team responded and resolved the issue. The support was professional, efficient, and very helpful. Easy Digital Downloads is a strong plugin, and the quality of support gives us confidence using it for our digital product sales. Highly recommended.

   Read on wp.org ↗
5. ★★★★★ ninoloco

   3mo ago

   I LOVE this plugin!! I use it on two websites and haven’t had any problems at all most of the time. It’s great that the basic version of the plugin is free. That’s fair for business beginners like me. Thank you so much for that. Please don’t change this plugin!

   Read on wp.org ↗
6. ★★★★★ danwpc

   3mo ago

   EDD has worked smoothly for years on my products. Customer support is always excellent. Great product, great service!

   Read on wp.org ↗
7. ★★★★★ 2fishone

   5mo ago

   this plugin works well

   Read on wp.org ↗
8. ★★★★★ Fetch Designs

   5mo ago

   EDD is a fantastic solution. It’s a solid plugin, built with great WordPress best practices, backed by super support and has a lot of great features.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.6.9 NEW: PayPal – Added support for Fastlane and additional payment methods for newly connected stores. Admin: Improved notice compatibility. Admin: Hardened sanitization of the banned emails setting. Admin: Sorted Checkout 3.6.9
2. — Version 3.6.8 NEW: Stripe – Added support for BLIK payments. Admin: Fixed the orders table filter by total not working with the “greater than” condition. Admin: Fixed manual order tax calculation requiring an address field change to t 3.6.8
3. — Version 3.6.7 NEW: Blocks – Introducing the Profile Editor Block. NEW: Checkout – Added a Business Name field to checkout addresses. NEW: Checkout – Returning customers can now log in via a secure email link at checkout. NEW: Purchase 3.6.7
4. — Version 3.6.6 Admin: Added compatibility with WordPress 7.0 admin changes. Cart: Fixed cart validation when adding multiple items at the same time. Cart: Improved mixed cart behavior with Stripe. Cart: Fixed a potential fatal error wh 3.6.6
5. — Version 3.6.5 NEW: Cron – Cron events are now more reliable and based on Action Scheduler. Cart: Fixed an unused variable in the cart class. Cart: The error handler has been improved to show messages more consistently. Checkout: Impro 3.6.5
6. — Version 3.6.4 New: Manage logs with the Log Retention Settings. Admin: Some help icons could get duplicated. Blocks: Login block could prevent WordPress admin email confirmation from working. Checkout: Improved billing address conditi 3.6.4

44 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter ↗
   2026-07-28 CVE-2026-12476 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.9 Patched in 3.6.9.1
2. Medium · 6.5 Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion ↗
   2026-07-27 CVE-2026-66476 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 3.6.9 Patched in 3.6.9.1
3. Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization ↗
   2026-07-22 CVE-2026-59524 Missing Authorization Affects <= 3.6.7 Patched in 3.6.8
4. Medium · 4.3 Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter ↗
   2026-05-27 CVE-2026-7533 Cross-Site Request Forgery (CSRF) Affects <= 3.6.7 Patched in 3.6.8
5. Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization ↗
   2026-04-20 CVE-2026-39503 Missing Authorization Affects <= 3.6.5 Patched in 3.6.6
6. Medium · 4.3 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect ↗
   2025-12-30 CVE-2025-14783 Weak Password Recovery Mechanism for Forgotten Password Affects <= 3.6.2 Patched in 3.6.3
7. Medium · 5.3 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation ↗
   2025-11-05 CVE-2025-11271 Reliance on Untrusted Inputs in a Security Decision Affects <= 3.5.2 Patched in 3.5.3
8. Medium · 5.4 Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions ↗
   2025-08-19 CVE-2025-8102 Cross-Site Request Forgery (CSRF) Affects <= 3.5.0 Patched in 3.5.1
9. Medium · 6.4 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode ↗
   2025-05-28 CVE-2025-4670 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.8.1 Patched in 3.3.9
10. Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure ↗
    2025-03-24 CVE-2025-2252 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.6.1 Patched in 3.3.7
11. Medium · 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title ↗
    2025-01-17 CVE-2024-13517 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.2 Patched in 3.3.3
12. Medium · 4.9 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download ↗
    2024-12-20 CVE-2024-12875 External Control of File Name or Path Affects <= 3.3.2 Patched in 3.3.3
13. Low · 3.7 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass ↗
    2024-12-16 CVE-2024-9654 Incorrect Authorization Affects 3.1 - 3.3.4 Patched in 3.3.5
14. High · 7.2 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization ↗
    2024-09-23 CVE-2022-2439 Deserialization of Untrusted Data Affects <= 3.3.3 Patched in 3.3.4
15. Medium · 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings ↗
    2024-08-09 CVE-2024-6691 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.2 Patched in 3.3.3
16. Low · 3.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text ↗
    2024-08-09 CVE-2024-6692 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.2 Patched in 3.3.3
17. Medium · 4.3 Easy Digital Downloads <= 3.2.12 - Missing Authorization ↗
    2024-08-07 CVE-2024-43162 Missing Authorization Affects <= 3.2.12 Patched in 3.3.1
18. Critical · 10.0 Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection ↗
    2024-08-01 CVE-2024-5057 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.2.12 Patched in 3.3.1
19. Medium · 4.3 Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery ↗
    2024-05-09 CVE-2024-31113 Cross-Site Request Forgery (CSRF) Affects <= 3.2.11 Patched in 3.2.12
20. Medium · 5.3 Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure ↗
    2024-05-09 CVE-2024-32100 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.2.11 Patched in 3.2.12
21. Medium · 4.3 Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery ↗
    2024-04-05 CVE-2024-31293 Cross-Site Request Forgery (CSRF) Affects <= 3.2.6 Patched in 3.2.7
22. Medium · 5.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure ↗
    2024-04-03 CVE-2024-2302 Insertion of Sensitive Information into Log File Affects <= 3.2.9 Patched in 3.2.10
23. Medium · 5.5 Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options ↗
    2024-02-02 CVE-2024-0659 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.2.6 Patched in 3.2.7
24. Medium · 6.4 Easy Digital Downloads <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-27 CVE-2023-51684 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.2.5 Patched in 3.2.6
25. Medium · 5.3 Easy Digital Downloads <= 3.1.5 - Missing Authorization ↗
    2023-12-26 CVE-2023-40005 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
26. Medium · 4.3 Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades ↗
    2023-06-07 Cross-Site Request Forgery (CSRF) Affects < 3.1.2 Patched in 3.1.2
27. Critical · 9.8 Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation ↗
    2023-05-02 CVE-2023-30869 Unverified Password Change Affects 3.1 - 3.1.1.4.2 Patched in 3.1.1.4.2
28. Medium · 6.4 Easy Digital Downloads <= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-01-30 CVE-2023-0380 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.0.4 Patched in 3.1.0.5
29. Critical · 9.8 Easy Digital Downloads < 3.1.0.4 - SQL Injection ↗
    2023-01-12 CVE-2023-23489 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.1.0.3 Patched in 3.1.0.4
30. High · 8.8 Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion ↗
    2022-10-17 CVE-2022-2387 Cross-Site Request Forgery (CSRF) Affects <= 2.11.7 Patched in 3.0
31. High · 8.8 Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection ↗
    2022-09-28 CVE-2022-3600 Improper Neutralization of Formula Elements in a CSV File Affects <= 3.1.0.1.1 Patched in 3.1.0.2
32. Critical · 9.8 Easy Digital Downloads <= 3.0.1 - PHP Object Injection ↗
    2022-08-10 CVE-2022-33900 Deserialization of Untrusted Data Affects <= 3.0.1 Patched in 3.0.2
33. High · 8.8 Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery ↗
    2022-04-09 CVE-2022-0707 Cross-Site Request Forgery (CSRF) Affects < 2.11.6 Patched in 2.11.6
34. Medium · 5.5 Easy Digital Downloads <= 2.11.5 - Admin+ Cross-Site Scripting ↗
    2022-03-28 CVE-2022-0706 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.11.6 Patched in 2.11.6
35. Medium · 4.8 Easy Digital Downloads <= 2.11.2 - Reflected Cross-Site Scripting ↗
    2021-10-21 CVE-2021-39354 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.2 Patched in 2.11.2.1
36. Medium · 5.4 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.11.2 - Reflected Cross-Site Scripting ↗
    2021-10-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.11.2 Patched in 2.11.2.1
37. Medium · 6.1 Easy Digital Downloads <= 2.10.3 - Reflected Cross-Site Scripting ↗
    2021-05-04 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.10.3 Patched in 2.10.4
38. Medium · 4.3 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.10.2 - Cross-Site Request Forgery ↗
    2021-04-16 Cross-Site Request Forgery (CSRF) Affects <= 2.10.2 Patched in 2.10.3
39. Medium · 4.3 Easy Digital Downloads <= 2.10.2 - Cross-Site Request Forgery ↗
    2021-04-14 Cross-Site Request Forgery (CSRF) Affects < 2.10.3 Patched in 2.10.3
40. Critical · 9.8 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection ↗
    2020-09-22 CVE-2015-9324 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.3.2 Patched in 2.3.3
41. Medium · 6.1 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.9.15 - Stored Cross-Site Scripting ↗
    2019-06-12 CVE-2019-15116 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.9.16 Patched in 2.9.16
42. Critical · 9.8 Easy Digital Downloads <= 2.5.7 - PHP Object Injection ↗
    2016-03-02 Deserialization of Untrusted Data Affects <= 2.5.7 Patched in 2.5.8
43. Medium · 6.1 Easy Digital Downloads (Various Versions) - Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9512 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 1.8 - 1.8.6 Patched in 1.8.7
44. Medium · 6.1 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9505 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.8.7 Patched in 1.8.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 93 languages, 13 at 90% or more

Plus 69 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-01 50K+ → 40K+ down after 136 days in tier
2. 2025-08-18 40K+ → 50K+ up after 24 days in tier
3. 2025-07-25 50K+ → 40K+ down after 6 days in tier
4. 2025-07-19 40K+ → 50K+ up after 67 days in tier
5. 2025-05-13 50K+ → 40K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 80K+ installs · 4.7★ · 3 shared tags A
• Contact Form 7 – PayPal & Stripe Add-on 7K+ installs · 4.1★ · 3 shared tags A
• WooCommerce PayPal Payments 800K+ installs · 2.9★ · 2 shared tags B
• WooCommerce Stripe Payment Gateway 700K+ installs · 3.1★ · 2 shared tags B
• Mollie Payments for WooCommerce 100K+ installs · 3.6★ · 2 shared tags B
• Download Manager 100K+ installs · 4.1★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Easy Digital Downloads – eCommerce Payments and Subscriptions made easy into a readme, a review or a deck. It updates itself.

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: 40K+ active installs, 4.7★ (590 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/easy-digital-downloads