Skip to content
PluginCanary

Easy Digital Downloads

Easy Digital Downloads - eCommerce Payments and Subscriptions made easy
by Syed Balkhi · 40,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 30 releases in 24 months, no unpatched vulnerabilities.

85/ 100 Canary Score
Sub-scores for Easy Digital Downloads
Ownership100
Maintenance100
Security60
Support94
Reputation70

How the score works

Quick answers

Is Easy Digital Downloads still maintained?
Yes. Last release 2 Nov 2026, 30 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Easy Digital Downloads, and has it changed hands?
No change recorded. Main committer cklosows since Jan 2015. 4 Nov 2026 · SVN log
Was Easy Digital Downloads removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Easy Digital Downloads safe?
51 known vulnerabilities, all fixed (latest in 3.7.3). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Easy Digital Downloads update safe to install?
No ownership change before 3.7.3. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
mordauk10 Apr 2012 to 3 Dec 2018, 325 commits
cklosows27 Jan 2015 to 2 Nov 2026, 245 commits
johnstonphilip29 Oct 2019 to 14 Nov 2019, 4 commits
BrashRebel8 Apr 2020 to 13 Apr 2020, 9 commits
NoseGraze9 Mar 2021 to 27 Jan 2022, 10 commits

5 committers recorded. No ownership change since 2012.

Maintenance

Last release
2 days ago
Releases, 24 months
30
Tested up to
7.1 current
Requires PHP
8.0 supported 8.2+
Releases per quarter
Releases per quarter for Easy Digital Downloads
Q1 20246
Q2 20241
Q3 20244
Q4 20243
Q1 20252
Q2 20253
Q3 20253
Q4 20256
Q1 20264
Q2 20263
Q3 20263
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 3.7 (3 reviews). Lifetime: 4.7.

Average rating per quarter for Easy Digital Downloads
Q2 20255.0
Q3 20255.0
Q4 20254.4
Q1 20265.0
Q2 20265.0
Q3 20263.7
Q4 20263.7

Average rating fell from 5.0 to 3.7 between Q2 2025 and Q4 2026.

Rating distribution
5 star538
4 star11
3 star4
2 star4
1 star35
Latest low reviews

Security record

20 vulnerabilities in 24 months (51 on record), all patched (latest fixed in 3.7.3).

Show 51 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture8.1<= 3.7.23.7.3Patched before disclosure
26 Oct 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Discount Code Limit Bypass5.3<= 3.7.13.7.2Patched before disclosure
9 Oct 2026Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters7.2<= 3.6.93.6.9.1Patched before disclosure
8 Oct 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure4.3< 3.7.13.7.1Patched before disclosure
6 Oct 2026Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation5.3<= 3.7.03.7.1Patched before disclosure
5 Oct 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization5.3<= 3.7.13.7.1.11
23 Sep 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection4.9<= 3.7.03.7.1Patched before disclosure
28 Jul 2026Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter7.2<= 3.6.93.6.9.1Patched before disclosure
27 Jul 2026Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion6.5<= 3.6.93.6.9.11
22 Jul 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization5.3<= 3.6.73.6.8Patched before disclosure
27 May 2026Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter4.3<= 3.6.73.6.8Patched before disclosure
20 Apr 2026Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization5.3<= 3.6.53.6.6Patched before disclosure
30 Dec 2025Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect4.3<= 3.6.23.6.3Patched before disclosure
5 Nov 2025Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation5.3<= 3.5.23.5.3Patched before disclosure
19 Aug 2025Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions5.4<= 3.5.03.5.1Patched before disclosure
28 May 2025Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode6.4<= 3.3.8.13.3.9Patched before disclosure
24 Mar 2025Easy Digital Downloads - eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure5.3<= 3.3.6.13.3.7Patched before disclosure
17 Jan 2025Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title4.4<= 3.3.23.3.3Patched before disclosure
20 Dec 2024Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download4.9<= 3.3.23.3.3Patched before disclosure
16 Dec 2024Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass3.73.1 to 3.3.43.3.5Patched before disclosure
23 Sep 2024Easy Digital Downloads - Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization7.2<= 3.3.33.3.4Patched before disclosure
9 Aug 2024Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text3.3<= 3.3.23.3.3Patched before disclosure
9 Aug 2024Easy Digital Downloads - Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings4.4<= 3.3.23.3.3Patched before disclosure
7 Aug 2024Easy Digital Downloads <= 3.2.12 - Missing Authorization4.3<= 3.2.123.3.1Patched before disclosure
1 Aug 2024Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection10<= 3.2.123.3.1Patched before disclosure

Changelog mentions of security fixes: 3.6.9 (sanitize); 3.7.1 (authorization, sanitize); 3.7.2 (security, authorization); 3.7.3 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

94% of 18 support threads resolved in the last 2 months.

Momentum

40,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Easy Digital Downloads
4 May 20261,276
11 May 20263,447
18 May 202622,893
25 May 20266,879
1 Jun 20264,651
8 Jun 20263,454
15 Jun 202618,065
22 Jun 20265,256
29 Jun 20264,116
6 Jul 20265,527
13 Jul 20263,849
20 Jul 20263,433
27 Jul 202623,675
3 Aug 20267,783
10 Aug 202616,727
17 Aug 20267,153
24 Aug 20264,705
31 Aug 20264,554
7 Sep 20263,703
14 Sep 20263,347
21 Sep 202622,105
28 Sep 20266,225
5 Oct 202621,703
12 Oct 202619,522
19 Oct 20266,393
26 Oct 202621,802
2 Nov 20261,554

Weekly downloads over the last 4 weeks are 31% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Ecwid by Lightspeed Ecommerce ShoppingScore 88 · 20,000+SureCartScore 86 · 80,000+Welcart e-CommerceScore 86 · 10,000+Simple Shopping CartScore 86 · 10,000+

Facts

Version3.7.3
AuthorSyed Balkhi
Added10 Apr 2012
Last updated2 Nov 2026
Active installs40,000+
Requires WordPress6.7
Tested up to7.1.4
Requires PHP8.0
CategoryE-commerce & Shopping
Tagsstripe, payments, ecommerce, digital store, sell digital products

Other plugins by this author: WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More, WP Mail SMTP by WPForms - SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More, WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager, All in One SEO - AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights), Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More, Popup Builder & Popup Maker for WordPress - OptinMonster Email Marketing and Lead Generation, One Click Demo Import, Smash Balloon Social Photo Feed - Easy Social Feeds Plugin, Easy WP SMTP - WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more, Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery, WP Mail Logging, WP Crontrol

Questions

Is Easy Digital Downloads still maintained?

Yes. Last release 2 Nov 2026, 30 releases in the last 24 months.

Who owns Easy Digital Downloads, and has it changed hands?

No change recorded. Main committer cklosows since Jan 2015.

Was Easy Digital Downloads removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Easy Digital Downloads safe?

51 known vulnerabilities, all fixed (latest in 3.7.3). Not on the exploited list.

Is the latest Easy Digital Downloads update safe to install?

No ownership change before 3.7.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue