Easy Digital Downloads - Software Licensing

Version 3.9.8 — 20 October 2026

• New Licenses can now be read and managed through the WordPress Abilities API (requires EDD 3.7.1 or later).
• Security Package download links are now signed with a site-specific secret, so their expiration can't be forged.
• Security The license renewal form no longer reveals a license's details or renewal price to anyone other than the license owner.
• Security Fixed an issue that allowed license upgrade and renewal prices to be changed at checkout.
• Security Fixed an information disclosure issue where the update API could describe unpublished or password-protected products.
• Security Fixed a stored cross-site scripting issue in the product changelog.
• Security Fixed a server-side request forgery issue in the product readme.txt location.
• Security Deleting a license, including through bulk actions, now requires the delete licenses capability.
• Security Added cross-site request forgery protection to the activation limit and renewal notice actions on the licenses screen.
• Security Fixed a reflected cross-site scripting issue on the licenses screen.
• Security Bulk actions on the licenses screen now require the same capabilities as their single-license versions.
• Security Fixed a SQL injection issue in the licenses list table’s sort order.
• Security Fixed an issue that could reveal another customer’s activated site URL when adding a site to a license.
• Security Exporting license keys now requires permission to manage licenses.
• Security Product changelogs, descriptions, and upgrade notices sent by the update API are now limited to the same HTML as other product content.
• Security Fixed a SQL injection issue in the license export’s status filter.
• Security Fixed an issue that let an unauthenticated request delete an order’s licenses while the order remained.
• Other The Licenses screen’s page title is now “Licenses”.
• Other Fixed the plugin requirements notice styling on the Plugins screen in WordPress 7.1.
• Other The license upgrades page no longer appears in the WordPress command palette.
• Other Fixed sending a renewal notice to an expired license from the licenses screen’s bulk actions.
• Other Clicking Filter on the licenses screen no longer runs the selected bulk action on checked licenses.
• Other The licenses screen keeps the search term and tab when it reloads after a bulk action.
• Other The update API no longer describes unpublished, private, or password-protected products unless the request includes an active or expired license for that product. A disabled license no longer counts.
• Other Restored the cancel button on the license renewal form.
• Other Update package download links use a new signature, so links generated before updating stop working. They expire on their own within the store’s download link expiration (24 hours by default).
• Security Product changelogs no longer allow scripts, iframes, or other HTML outside what post content allows, so embedded videos in a changelog are removed.
• Security A product’s readme.txt location must be a public URL. Local and private network addresses are no longer fetched, and invalid URLs aren’t saved.
• Other Renewal notices are no longer sent for licenses whose product has been deleted.
• Other Fixed the bulk Send Renewal Notice action sending nothing for licenses that had not expired.
• New A license must be attached to a user account to be upgraded. A license with no account, such as one from a guest purchase, can no longer be upgraded.
• Fixed Fixed a fatal error when running retroactive licensing on bundles with an unresolvable child license.
• Improved In the license renewal form and block, a license attached to a user account can only be renewed by that user.
• Improved With email matching enabled, a guest renewing a license attached to an account is now asked to log in.
• Improved Renewing a license no longer removes the same product from the cart when it’s already there as a new purchase. Both stay in the cart.
• Improved Fixed a false “already in your cart” message when renewing a product that was in the cart as a new purchase.
• Other Deprecated EDD_Software_Licensing::get_download_package(). Use EDD\SoftwareLicensing\Downloads\Package::get_download_package().

Earlier versions

• 3.9.7 (29 June 2026): 2 new, 7 improved, 3 fixed
• 3.9.6 (4 May 2026): 3 improved, 2 fixed
• 3.9.5 (26 January 2026): 5 improved, 1 fixed, 1 security