549 matches found
WordPress Sell Media 2.4.1 - Cross-Site Scripting
WordPress Plugin Sell Media v2.4.1 contains a cross-site scripting vulnerability in /inc/class-search.php that allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. id: CVE-2019-6112 info: name: WordPress Sell Media 2.4.1 -...
CVE-2025-26206
CVE-2025-26206: Cross-Site Request Forgery CSRF in Sell Done Storefront v.1.0 -critical.svg -blue.svg A critical Cross-Site Request Forgery CSRF vulnerability in Selldone Storefront v1.0 allows remote attackers to escalate privileges by tricking authenticated users into executing state-changing...
CVE-2026-110664
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-102786
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-18586
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
EUVD-2026-101842
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-94590
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...
CVE-2026-94590
The CodePeople2 Sell Downloads WordPress plugin, affecting versions up to and including 1.2.3 , contains a Broken Access Control vulnerability. This issue is characterized as an Improper Verification of Source of a Communication Channel , which can lead to the Exploitation of Trusted Credentials ...
CVE-2026-94590 WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...
EUVD-2026-96397
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...
CVE-2026-103478
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...
EUVD-2026-96290
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...
CVE-2026-94590: Improper Verification of Source of a Communication Channel
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...
CVE-2026-103478: Improper Neutralization of Input During Web Page Generation
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...
WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.6...
WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by c4st1e in WordPress Plugin Sell Downloads versions = 1.2.3...
PT-2026-104489
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
EUVD-2026-90544
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
CVE-2026-93882: Authorization Bypass Through User-Controlled Key
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...