Premium Packages – Sell Digital Products Securely - SQL Injection

Premium Packages – Sell Digital Products Securely WordPress plugin = 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries. id: CVE-2026-12800...

CVE-2025-24659

CVE-2025-24659 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Premium Packages – Sell Digital Products Securely Vulnerable version Since the Premium Packages plugin is an addon...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Coopernicus in WordPress Plugin WPDM – Premium Packages versions = 7.2.1...

WordPress Premium Packages - Sell Digital Products Securely plugin < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability

WordPress Premium Packages - Sell Digital Products Securely plugin 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability discovered by Farid Narimanov in WordPress Plugin WPDM – Premium Packages versions 7.0.7...

CVE-2026-73190

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5...

EUVD-2026-60768

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190 WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73190

WPDM – Premium Packages WordPress plugin versions ≤ 7.0.5 contain an unauthenticated reflected XSS vulnerability discovered by Evan NR. A remote attacker can craft a malicious URL requiring no authentication or privileges; a victim visiting it triggers script execution in their browser (scope cha...

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin WPDM – Premium Packages versions = 7.0.5...

CVE-2026-73190: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5...

PT-2026-77083

Name of the Vulnerable Software and Affected Versions WPDM – Premium Packages versions prior to 7.0.6 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.2.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.0.4 - Authentication Bypass to Non-Admin vulnerability

Authentication Bypass to Non-Admin vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.0.4...

Wpdm-Cache Session Detection

Leaked session of Wpdm Cache wordpress plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked session of Wpdm Cache wordpress plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wpdm-Cache Session Detection'...

CVE-2026-61948 WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61943: Missing Authorization

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-5357 Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdmmembers' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute...