CVE-2025-24659

CVE-2025-24659 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Premium Packages – Sell Digital Products Securely Versión vulnerable = 5.9.6 Slug del componente wpdm-premium-packages Enlace del componente...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Coopernicus in WordPress Plugin WPDM – Premium Packages versions = 7.2.1...

WordPress Premium Packages - Sell Digital Products Securely plugin < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability

WordPress Premium Packages - Sell Digital Products Securely plugin 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability discovered by Farid Narimanov in WordPress Plugin WPDM – Premium Packages versions 7.0.7...

CVE-2026-73190

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

EUVD-2026-60768

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190

WPDM – Premium Packages WordPress plugin versions ≤ 7.0.5 contain an unauthenticated reflected XSS vulnerability discovered by Evan NR. A remote attacker can craft a malicious URL requiring no authentication or privileges; a victim visiting it triggers script execution in their browser (scope cha...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin WPDM – Premium Packages versions = 7.0.5...

CVE-2026-73190: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

PT-2026-77083

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.2.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.0.4 - Authentication Bypass to Non-Admin vulnerability

Authentication Bypass to Non-Admin vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.0.4...

CVE-2026-61948 WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61943: Missing Authorization

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-5357 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdmmembers' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute...

CVE-2026-24956

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through = 1.3.0...

EUVD-2025-204248

The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the wpdmmediaaccess AJAX action. This makes it possible for authenticated attackers,...