CVE-2023-23489: Sandhillsdev Easy Digital Downloads

Critical severity, CVSS 9.8. EPSS: 11.2% chance of exploitation in the next 30 days.

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.

Affected products

• Sandhillsdev Easy Digital Downloads: before 3.1.0.4 (fixed in 3.1.0.4)

Published 2023-01-20. Last modified 2026-06-17.