escape download handler URLs
esc_url_raw to readfile home_url()
esc_url applied to readfile home_url()

This should fix it.

Thank you Mike for the info on esc_html.
Introduce woocommerce_pay_order_button_text and woocommerce_pay_order_button_html filters
Finnish with corrections, for WC 2.0.20
Merge pull request #4260 from arhipaiva/master

Finnish with corrections, for WC 2.0.20
Merge pull request #4214 from toddlahman/master

escape download handler URLs
Esnure cron is scheduled for midnight Closes #4267
Use function for lost password url
Merge pull request #4242 from ragulka/pay-order-button-filter

Allow filtering Pay for order button text and html
removing unnecessary index.php file
Merge pull request #4274 from BFTrick/remove-index

Removing Unnecessary index.php File
Show names and urls for emails in plain text Closes #4259
twenty fourteen compat. closes #4272
readme
Update readme.txt
Merge pull request #4277 from Ramoonus/patch-1

Update readme.txt
Get rid of "FROM" - display a price range, localisable. Closes #4222
wp_redirects
sort sale price