Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1358 searches this plugin appeared in over the last 90 days, 20 listed. 1154 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 10 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ alain2204

   4mo ago

   Réponse rapide et efficace

   Read on wp.org ↗
2. ★★★★★ graham49

   5mo ago

   I was struggling with some of the more complex issues within WordPress and although I struggled with the EDD AI support, when I got through to a human being the problem was solved totally and politely (I would also add with a high degree of patience!). I’m most grateful. GH

   Read on wp.org ↗
3. ★★★★★ Md. Sarwar Zaman

   5mo ago

   If you sell digital assets, EDD is the absolute best framework available. It’s built cleanly on core WordPress standards, handles complex workflows flawlessly right out of the box, and is backed by a remarkably responsive, expert support team.

   Read on wp.org ↗
4. ★★★★★ dfathers

   5mo ago

   We were experiencing issues with the Easy Digital Downloads shopping cart and contacted support for assistance. Within approximately two hours, their team responded and resolved the issue. The support was professional, efficient, and very helpful. Easy Digital Downloads is a strong plugin, and the quality of support gives us confidence using it for our digital product sales. Highly recommended.

   Read on wp.org ↗
5. ★★★★★ ninoloco

   6mo ago

   I LOVE this plugin!! I use it on two websites and haven’t had any problems at all most of the time. It’s great that the basic version of the plugin is free. That’s fair for business beginners like me. Thank you so much for that. Please don’t change this plugin!

   Read on wp.org ↗
6. ★★★★★ danwpc

   6mo ago

   EDD has worked smoothly for years on my products. Customer support is always excellent. Great product, great service!

   Read on wp.org ↗
7. ★★★★★ 2fishone

   7mo ago

   this plugin works well

   Read on wp.org ↗
8. ★★★★★ Fetch Designs

   8mo ago

   EDD is a fantastic solution. It’s a solid plugin, built with great WordPress best practices, backed by super support and has a lot of great features.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.6.9 NEW: PayPal – Added support for Fastlane and additional payment methods for newly connected stores. Admin: Improved notice compatibility. Admin: Hardened sanitization of the banned emails setting. Admin: Sorted Checkout 3.6.9
2. — Version 3.6.8 NEW: Stripe – Added support for BLIK payments. Admin: Fixed the orders table filter by total not working with the “greater than” condition. Admin: Fixed manual order tax calculation requiring an address field change to t 3.6.8
3. — Version 3.6.7 NEW: Blocks – Introducing the Profile Editor Block. NEW: Checkout – Added a Business Name field to checkout addresses. NEW: Checkout – Returning customers can now log in via a secure email link at checkout. NEW: Purchase 3.6.7
4. — Version 3.6.6 Admin: Added compatibility with WordPress 7.0 admin changes. Cart: Fixed cart validation when adding multiple items at the same time. Cart: Improved mixed cart behavior with Stripe. Cart: Fixed a potential fatal error wh 3.6.6
5. — Version 3.6.5 NEW: Cron – Cron events are now more reliable and based on Action Scheduler. Cart: Fixed an unused variable in the cart class. Cart: The error handler has been improved to show messages more consistently. Checkout: Impro 3.6.5
6. — Version 3.6.4 New: Manage logs with the Log Retention Settings. Admin: Some help icons could get duplicated. Blocks: Login block could prevent WordPress admin email confirmation from working. Checkout: Improved billing address conditi 3.6.4

All 51 disclosed vulnerabilities are patched in the current version (3.7.3). Sites still on an older version should update.

1. Patched High · 8.1 Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture ↗
   2026-10-30 Improper Authentication Affects <= 3.7.2 Patched in 3.7.3
2. Patched Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Discount Code Limit Bypass ↗
   2026-10-26 CVE-2026-116403 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 3.7.1 Patched in 3.7.2
3. Patched High · 7.2 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters ↗
   2026-10-09 CVE-2026-14335 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.9 Patched in 3.6.9.1
4. Patched Medium · 4.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure ↗
   2026-10-08 CVE-2026-105194 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.7.1 Patched in 3.7.1
5. Patched Medium · 5.3 Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation ↗
   2026-10-06 CVE-2026-105190 Missing Authorization Affects <= 3.7.0 Patched in 3.7.1
6. Patched Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization ↗
   2026-10-05 CVE-2026-42638 Missing Authorization Affects <= 3.7.1 Patched in 3.7.1.1
7. Patched Medium · 4.9 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection ↗
   2026-09-23 CVE-2026-95522 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.0 Patched in 3.7.1
8. Patched High · 7.2 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter ↗
   2026-07-28 CVE-2026-12476 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.9 Patched in 3.6.9.1
9. Patched Medium · 6.5 Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion ↗
   2026-07-27 CVE-2026-66476 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.6.9 Patched in 3.6.9.1
10. Patched Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization ↗
    2026-07-22 CVE-2026-59524 Missing Authorization Affects <= 3.6.7 Patched in 3.6.8
11. Patched Medium · 4.3 Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter ↗
    2026-05-27 CVE-2026-7533 Cross-Site Request Forgery Affects <= 3.6.7 Patched in 3.6.8
12. Patched Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization ↗
    2026-04-20 CVE-2026-39503 Missing Authorization Affects <= 3.6.5 Patched in 3.6.6
13. Patched Medium · 4.3 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect ↗
    2025-12-30 CVE-2025-14783 Weak Password Recovery Mechanism for Forgotten Password Affects <= 3.6.2 Patched in 3.6.3
14. Patched Medium · 5.3 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation ↗
    2025-11-05 CVE-2025-11271 Reliance on Untrusted Inputs in a Security Decision Affects <= 3.5.2 Patched in 3.5.3
15. Patched Medium · 5.4 Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions ↗
    2025-08-19 CVE-2025-8102 Cross-Site Request Forgery Affects <= 3.5.0 Patched in 3.5.1
16. Patched Medium · 6.4 Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode ↗
    2025-05-28 CVE-2025-4670 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.8.1 Patched in 3.3.9
17. Patched Medium · 5.3 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure ↗
    2025-03-24 CVE-2025-2252 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.3.6.1 Patched in 3.3.7
18. Patched Medium · 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title ↗
    2025-01-17 CVE-2024-13517 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.2 Patched in 3.3.3
19. Patched Medium · 4.9 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download ↗
    2024-12-20 CVE-2024-12875 External Control of File Name or Path Affects <= 3.3.2 Patched in 3.3.3
20. Patched Low · 3.7 Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass ↗
    2024-12-16 CVE-2024-9654 Incorrect Authorization Affects 3.1 - 3.3.4 Patched in 3.3.5
21. Patched High · 7.2 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization ↗
    2024-09-23 CVE-2022-2439 Deserialization of Untrusted Data Affects <= 3.3.3 Patched in 3.3.4
22. Patched Medium · 4.4 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings ↗
    2024-08-09 CVE-2024-6691 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.2 Patched in 3.3.3
23. Patched Low · 3.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text ↗
    2024-08-09 CVE-2024-6692 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.2 Patched in 3.3.3
24. Patched Medium · 4.3 Easy Digital Downloads <= 3.2.12 - Missing Authorization ↗
    2024-08-07 CVE-2024-43162 Missing Authorization Affects <= 3.2.12 Patched in 3.3.1
25. Patched Critical · 10.0 Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection ↗
    2024-08-01 CVE-2024-5057 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.2.12 Patched in 3.3.1
26. Patched Medium · 4.3 Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery ↗
    2024-05-09 CVE-2024-31113 Cross-Site Request Forgery Affects <= 3.2.11 Patched in 3.2.12
27. Patched Medium · 5.3 Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure ↗
    2024-05-09 CVE-2024-32100 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.2.11 Patched in 3.2.12
28. Patched Medium · 4.3 Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery ↗
    2024-04-05 CVE-2024-31293 Cross-Site Request Forgery Affects <= 3.2.6 Patched in 3.2.7
29. Patched Medium · 5.3 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure ↗
    2024-04-03 CVE-2024-2302 Insertion of Sensitive Information into Log File Affects <= 3.2.9 Patched in 3.2.10
30. Patched Medium · 5.5 Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options ↗
    2024-02-02 CVE-2024-0659 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.6 Patched in 3.2.7
31. Patched Medium · 6.4 Easy Digital Downloads <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-12-27 CVE-2023-51684 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.5 Patched in 3.2.6
32. Patched Medium · 5.3 Easy Digital Downloads <= 3.1.5 - Missing Authorization ↗
    2023-12-26 CVE-2023-40005 Missing Authorization Affects <= 3.1.5 Patched in 3.2.0
33. Patched Medium · 4.3 Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades ↗
    2023-06-07 Cross-Site Request Forgery Affects < 3.1.2 Patched in 3.1.2
34. Patched Critical · 9.8 Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation ↗
    2023-05-02 CVE-2023-30869 Unverified Password Change Affects 3.1 - 3.1.1.4.2 Patched in 3.1.1.4.2
35. Patched Medium · 6.4 Easy Digital Downloads <= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-01-30 CVE-2023-0380 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.0.4 Patched in 3.1.0.5
36. Patched Critical · 9.8 Easy Digital Downloads < 3.1.0.4 - SQL Injection ↗
    2023-01-12 CVE-2023-23489 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.1.0.3 Patched in 3.1.0.4
37. Patched High · 8.8 Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion ↗
    2022-10-17 CVE-2022-2387 Cross-Site Request Forgery Affects <= 2.11.7 Patched in 3.0
38. Patched High · 8.8 Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection ↗
    2022-09-28 CVE-2022-3600 Improper Neutralization of Formula Elements in a CSV File Affects <= 3.1.0.1.1 Patched in 3.1.0.2
39. Patched Critical · 9.8 Easy Digital Downloads <= 3.0.1 - PHP Object Injection ↗
    2022-08-10 CVE-2022-33900 Deserialization of Untrusted Data Affects <= 3.0.1 Patched in 3.0.2
40. Patched High · 8.8 Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery ↗
    2022-04-09 CVE-2022-0707 Cross-Site Request Forgery Affects < 2.11.6 Patched in 2.11.6
41. Patched Medium · 5.5 Easy Digital Downloads <= 2.11.5 - Admin+ Cross-Site Scripting ↗
    2022-03-28 CVE-2022-0706 Improper Neutralization of Input During Web Page Generation Affects < 2.11.6 Patched in 2.11.6
42. Patched Medium · 4.8 Easy Digital Downloads <= 2.11.2 - Reflected Cross-Site Scripting ↗
    2021-10-21 CVE-2021-39354 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.2 Patched in 2.11.2.1
43. Patched Medium · 5.4 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.11.2 - Reflected Cross-Site Scripting ↗
    2021-10-19 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.2 Patched in 2.11.2.1
44. Patched Medium · 6.1 Easy Digital Downloads <= 2.10.3 - Reflected Cross-Site Scripting ↗
    2021-05-04 Improper Neutralization of Input During Web Page Generation Affects <= 2.10.3 Patched in 2.10.4
45. Patched Medium · 4.3 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.10.2 - Cross-Site Request Forgery ↗
    2021-04-16 Cross-Site Request Forgery Affects <= 2.10.2 Patched in 2.10.3
46. Patched Medium · 4.3 Easy Digital Downloads <= 2.10.2 - Cross-Site Request Forgery ↗
    2021-04-14 Cross-Site Request Forgery Affects < 2.10.3 Patched in 2.10.3
47. Patched Critical · 9.8 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection ↗
    2020-09-22 CVE-2015-9324 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.3.2 Patched in 2.3.3
48. Patched Medium · 6.1 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.9.15 - Stored Cross-Site Scripting ↗
    2019-06-12 CVE-2019-15116 Improper Neutralization of Input During Web Page Generation Affects < 2.9.16 Patched in 2.9.16
49. Patched Critical · 9.8 Easy Digital Downloads <= 2.5.7 - PHP Object Injection ↗
    2016-03-02 Deserialization of Untrusted Data Affects <= 2.5.7 Patched in 2.5.8
50. Patched Medium · 6.1 Easy Digital Downloads (Various Versions) - Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9512 Improper Neutralization of Input During Web Page Generation Affects 1.8 - 1.8.6 Patched in 1.8.7
51. Patched Medium · 6.1 Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9505 Improper Neutralization of Input During Web Page Generation Affects < 1.8.7 Patched in 1.8.7

Translated into 91 languages, 3 at 90% or more

Plus 67 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-01 50K+ → 40K+ down after 136 days in tier
2. 2025-08-18 40K+ → 50K+ up after 24 days in tier
3. 2025-07-25 50K+ → 40K+ down after 6 days in tier
4. 2025-07-19 40K+ → 50K+ up after 67 days in tier
5. 2025-05-13 50K+ → 40K+ down after 1412 days in tier
6. 2021-07-01 60K+ → 50K+ down after 1597 days in tier
7. 2017-02-15 50K+ → 60K+ up after 380 days in tier
8. 2016-02-01 40K+ → 50K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Easy Digital Downloads – eCommerce Payments and Subscriptions made easy into a readme, a review or a deck. It updates itself.

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: 40K+ active installs, 4.7★ (591 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/easy-digital-downloads