100 matches found
CVE-2026-93511 Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...
CVE-2026-93511
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id the...
CVE-2025-24659
CVE-2025-24659 1️⃣ 组件类型 WordPress 插件 2️⃣ 组件详情 组件名称 Premium Packages – Sell Digital Products Securely 受影响版本 由于 Premium Packages 插件是 Download Manager 插件（https://wordpress.org/plugins/download-manager/）的附加组件，因此也必须安装并激活 Download Manager 插件。 2. 访问以下 URL 后，SQL 查询条件（1=1）始终为真，由于 SLEEP5 函数，页面会在 5 秒后显示。...
CVE-2026-73190
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
EUVD-2026-60768
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
CVE-2026-73190
Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...
CVE-2026-73190
WPDM – Premium Packages WordPress plugin versions ≤ 7.0.5 contain an unauthenticated reflected XSS vulnerability discovered by Evan NR. A remote attacker can craft a malicious URL requiring no authentication or privileges; a victim visiting it triggers script execution in their browser (scope cha...
CVE-2026-19711
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...
CVE-2026-19711
The Premium Packages WordPress plugin before 7.0.7 fails to validate withdrawal requests against the requesting user's earned balance, letting any authenticated subscriber submit a payout for an arbitrary amount an administrator may approve. Fix: upgrade to version 7.0.7 or later. No exploit code...
CVE-2026-19711
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...
CVE-2026-19711 Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...
EUVD-2026-59914
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...
CVE-2026-12800
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...
CVE-2026-12800
The CVE-2026-12800 affects the Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to 6.2.0). A SQL Injection exists via the code parameter in the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Root cause: user-supplied code is interpolated directly into a raw ...
PT-2026-65412
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...