Easy Digital Downloads - Frontend Submissions

Version 2.8.3 — 20 October 2026

• Security Vendor profile saving now checks permission on the account being changed, so a logged-in user can no longer change another user’s email address or details.
• Security Restricted approved vendors from seeing other authors’ private products in store listings or editing product categories and tags.
• Security Approving downloads from the Downloads list now requires permission to publish each one, so vendors can no longer skip store review or publish other vendors’ pending products, posts, or pages.
• Security The vendor registration, login, and contact forms now always apply the reCAPTCHA and required fields set in the FES settings.
• Security Limited taxonomy suggestions on vendor forms to product taxonomies, so approved vendors no longer see unrelated term names.
• Security Prevented visitors who weren’t logged in from changing vendors’ recorded sales and earnings.
• Security Removed old FES upgrade routines that visitors who weren’t logged in could run to delete vendor roles and create unapproved vendor records.
• Security Restricted approved vendors to editing only the products they authored, rather than any post, page, or product.
• Security Blocked other websites from making a user an approved vendor when a store admin visited them while logged in.
• Security Blocked other websites from changing a vendor’s status when a store admin visited them while logged in.
• Security Vendor display names are now made safe on the admin vendor profile, so unsafe content entered at registration no longer runs when a store admin views it.
• Security Closed a gap on the FES tools and upgrades screens that let a crafted link run unwanted actions as the store admin who opened it.
• Security Vendor dashboard comment replies are now posted as the replying vendor and only on their own products, and can no longer hide comments from other vendors’ dashboards.
• Security Product files added through the vendor pricing field must now be the vendor’s own uploads or links to another site, not protected files stored on the site.
• Security Vendors can now view a receipt only for orders containing their own products, rather than any order’s customer details, license keys, or subscriptions.
• Security Corrected vendors list searching and sorting, which let store managers, or a crafted link opened by one, read or change data in the store’s database.
• Security The FES login form now signs a visitor into only the account whose password they entered.
• Security Vendor file fields now accept only media files the vendor uploaded.
• Other Vendor addresses are now edited in a modal.
• Other Vendors are now redirected away from admin screens they shouldn’t reach in every case.
• Other Saving a vendor profile no longer adds backslashes to names and addresses containing quotes or apostrophes.
• Fixed Taxonomy term suggestions on vendor forms were fixed, which failed on PHP 8.
• Fixed Fixed a WordPress 6.7 notice about translations loading too early.
• Fixed Fixed a PHP warning when recounting vendor statistics for vendors with no products.
• Improved Removed the outdated Pre-FES 2.4 import/export and Reset All Forms tools, and laid out the remaining Frontend Submissions tools as cards.
• Fixed Fixed an undefined variable notice in the vendor cache.
• Improved FES forms now refuse to save when the form ID doesn’t match the type of form being saved.
• Improved Removed the FES 2.2 and 2.3 upgrade routines, which current installs no longer use.
• Improved Deprecated fes_tools_page() , fes_get_tools_tabs() , and fes_process_form_tools() ; the FES tools now submit through EDD’s admin action router and require manage_shop_settings.
• Improved The minimum requirements are now PHP 7.4, WordPress 6.2, and EDD 3.4.0, and the addon tools library has been updated.

Earlier versions

• 2.8.2 (11 June 2024): 1 new, 3 improved, 1 fixed