Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
96 vulnerabilities by codename065
CVE-2026-18586 (GCVE-0-2026-18586)
Vulnerability from nvd – Published: 2026-10-15 05:30 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:45:44.770432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:41.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "thevietronin"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via \u0027order_email\u0027 in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T05:30:21.725Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53bbed98-7874-44dd-9ded-4012250f8aae?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3637473/wpdm-premium-packages/trunk/src/Admin/Order/views/list-orders.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-08-02T20:00:41.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-14T16:34:50.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via \u0027order_email\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18586",
"datePublished": "2026-10-15T05:30:21.725Z",
"dateReserved": "2026-08-02T19:45:25.828Z",
"dateUpdated": "2026-10-15T16:43:41.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103478 (GCVE-0-2026-103478)
Vulnerability from nvd – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:11.873018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027checkout[billing][phone] (and state / taxid / email)\u0027 parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:48.934Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L424"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L190"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724154/wpdm-premium-packages/trunk/templates/dashboard/billing-info.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T16:28:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:08:31.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027checkout[billing][phone]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103478",
"datePublished": "2026-10-10T07:41:48.934Z",
"dateReserved": "2026-09-30T16:13:38.557Z",
"dateUpdated": "2026-10-11T12:13:43.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12054 (GCVE-0-2026-12054)
Vulnerability from nvd – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Summary
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:14 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.57
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:14:33.892109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:56.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.57",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuvraj Tomar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027REFERRER\u0027 parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim\u0027s browser."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:31:07.853Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3573804/download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-06T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-06-12T01:31:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T16:40:06.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via \u0027REFERRER\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12054",
"datePublished": "2026-10-10T05:31:07.853Z",
"dateReserved": "2026-06-12T01:15:50.084Z",
"dateUpdated": "2026-10-11T12:23:56.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9696 (GCVE-0-2026-9696)
Vulnerability from nvd – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.58
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:17:17.469625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:58.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.58",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027not_found\u0027 parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:47.958Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e11e8-de23-469e-9b96-3fc24b03bf98?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=download-manager/tags/3.3.58/src/Package/Shortcodes.php\u0026old=3574454\u0026new_path=download-manager/tags/3.3.59/src/Package/Shortcodes.php\u0026new=3588497"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-05-27T12:06:58.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:57:15.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9696",
"datePublished": "2026-10-10T04:26:47.958Z",
"dateReserved": "2026-05-27T11:51:14.822Z",
"dateUpdated": "2026-10-11T12:23:58.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103964 (GCVE-0-2026-103964)
Vulnerability from nvd – Published: 2026-10-10 04:26 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Summary
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:43 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.71
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:43:09.714004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:19.438Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.71",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sawyer"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the \u0027first_name\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator\u0027s full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator\u0027s authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker\u0027s account, which causes the plugin to synchronously compile and send the suspension email inside the administrator\u0027s authenticated HTTP request \u2014 making the administrator\u0027s session cookies available to the template engine at send time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:45.587Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84791a83-197b-4a73-826d-517bf47bc5c9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L533"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L383"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php#L180"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php#L151"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724472/download-manager/trunk/src/__/Email.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T15:51:55.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:29:44.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in \u0027first_name\u0027 Profile Field Token Injection into Suspension Email"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103964",
"datePublished": "2026-10-10T04:26:45.587Z",
"dateReserved": "2026-10-01T15:36:47.334Z",
"dateUpdated": "2026-10-11T16:55:19.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102401 (GCVE-0-2026-102401)
Vulnerability from nvd – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:18 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.71
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:18:00.378166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:59.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.71",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027regurl\u0027 parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:44.010Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5985b0-0e6c-4dd8-b5f8-53be62adc8dd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/views/login-form.php#L140"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724472/download-manager/trunk/src/User/views/login-form.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-29T00:31:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:29:40.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027regurl\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102401",
"datePublished": "2026-10-10T04:26:44.010Z",
"dateReserved": "2026-09-29T00:16:17.679Z",
"dateUpdated": "2026-10-11T12:23:59.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97338 (GCVE-0-2026-97338)
Vulnerability from nvd – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.70
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:28:57.664357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.70",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:28.690Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e04b75d4-9bf5-4b26-ac3a-88a10d200c50?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L979"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/User/EditProfile.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L300"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L224"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3715131%40download-manager\u0026new=3715131%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-24T12:37:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T18:53:39.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-97338",
"datePublished": "2026-10-02T07:39:28.690Z",
"dateReserved": "2026-09-24T12:22:48.989Z",
"dateUpdated": "2026-10-03T15:42:48.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93654 (GCVE-0-2026-93654)
Vulnerability from nvd – Published: 2026-09-25 07:40 – Updated: 2026-09-25 10:31
VLAI
EPSS
VEX
Title
Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 10:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T10:31:03.562692Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:31:18.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Coopernicus"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027cart_items[][product_name]\u0027 Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:40:25.922Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38e3a2a4-3d35-4de9-9b44-568eab0c44f6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/templates/invoices/default/invoice.php#L167"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/includes/libs/cart-functions.php#L483"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartService.php#L328"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartItem.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Order/OrderService.php#L1255"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3708519%40wpdm-premium-packages\u0026new=3708519%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T13:32:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-24T19:07:59.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via \u0027cart_items[][product_name]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93654",
"datePublished": "2026-09-25T07:40:25.922Z",
"dateReserved": "2026-09-18T13:17:24.991Z",
"dateUpdated": "2026-09-25T10:31:18.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92714 (GCVE-0-2026-92714)
Vulnerability from nvd – Published: 2026-09-18 06:38 – Updated: 2026-09-18 11:37
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Summary
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 11:37 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T11:37:03.587882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T11:37:21.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.68",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pb\u003esec"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic \u0027edit_posts\u0027 capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata \u2014 including protected file references, role-based access restrictions, and password lock settings \u2014 into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:38:52.943Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64cc-75c2-46ba-a086-15a952a20026?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Package/PackageController.php#L2425"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3699609%40download-manager\u0026new=3699609%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T16:49:44.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T18:30:10.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via \u0027wpdm_duplicate\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92714",
"datePublished": "2026-09-18T06:38:52.943Z",
"dateReserved": "2026-09-16T16:34:40.641Z",
"dateUpdated": "2026-09-18T11:37:21.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16685 (GCVE-0-2026-16685)
Vulnerability from nvd – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:38
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 17:37 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.66
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:37:40.845674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:38:14.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.66",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:48.762Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3628015%40download-manager\u0026new=3628015%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T22:55:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:29:43.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16685",
"datePublished": "2026-08-01T07:49:48.762Z",
"dateReserved": "2026-07-22T22:39:53.074Z",
"dateUpdated": "2026-08-03T17:38:14.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12800 (GCVE-0-2026-12800)
Vulnerability from nvd – Published: 2026-07-28 08:34 – Updated: 2026-07-28 13:57
VLAI
EPSS
VEX
Title
Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 13:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 6.2.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T13:57:27.011084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T13:57:37.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "6.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Talal Nasraddeen"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the \u0027code\u0027 parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-\u003eprepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T08:34:36.797Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L82"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T21:11:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-27T19:51:50.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 6.2.0 - Unauthenticated SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12800",
"datePublished": "2026-07-28T08:34:36.797Z",
"dateReserved": "2026-06-20T19:53:36.643Z",
"dateUpdated": "2026-07-28T13:57:37.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15906 (GCVE-0-2026-15906)
Vulnerability from nvd – Published: 2026-07-23 08:34 – Updated: 2026-07-23 13:54
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:54 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:54:50.411481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:54:59.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the \u0027orderby\u0027 parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T08:34:40.801Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc6d516-7636-45b2-ade1-c8f2297f0ea1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Admin/Order/views/list-order-renews.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Admin/Order/views/list-order-renews.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Admin/Order/views/list-order-renews.php#L51"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Order/OrderService.php#L314"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Admin/Order/views/list-order-renews.php#L51"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Order/OrderService.php#L314"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611573%40wpdm-premium-packages\u0026new=3611573%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-15T19:02:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:29:48.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.4 - Authenticated (Admin+) SQL Injection via \u0027orderby\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15906",
"datePublished": "2026-07-23T08:34:40.801Z",
"dateReserved": "2026-07-15T18:47:23.077Z",
"dateUpdated": "2026-07-23T13:54:59.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15348 (GCVE-0-2026-15348)
Vulnerability from nvd – Published: 2026-07-23 09:33 – Updated: 2026-07-23 13:54
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:54 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:54:29.277922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:54:38.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function \u2014 hooked to the unauthenticated WordPress `wp` action \u2014 decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T09:33:56.289Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0183866d-1eab-4982-b62e-77751c7e738c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L585"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/includes/libs/functions.php#L1811"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L585"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/includes/libs/functions.php#L1811"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611573%40wpdm-premium-packages\u0026new=3611573%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T21:11:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:55:31.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.4 - Authentication Bypass to Non-Admin via \u0027wpdmppdl\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15348",
"datePublished": "2026-07-23T09:33:56.289Z",
"dateReserved": "2026-07-09T20:39:47.692Z",
"dateUpdated": "2026-07-23T13:54:38.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14343 (GCVE-0-2026-14343)
Vulnerability from nvd – Published: 2026-07-09 06:52 – Updated: 2026-07-09 17:31
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 17:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.61
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T17:31:04.036777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:31:10.016Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.61",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027note_before\u0027 and \u0027note_after\u0027 Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T06:52:45.773Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74cd34be-008c-4ff3-ae3c-417cfd2fee9b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php#L69"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php#L123"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php#L32"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3594267%40download-manager\u0026new=3594267%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-01T14:41:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-08T18:12:21.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027note_before\u0027 and \u0027note_after\u0027 Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14343",
"datePublished": "2026-07-09T06:52:45.773Z",
"dateReserved": "2026-07-01T14:26:42.757Z",
"dateUpdated": "2026-07-09T17:31:10.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13733 (GCVE-0-2026-13733)
Vulnerability from nvd – Published: 2026-07-01 07:53 – Updated: 2026-07-01 10:32
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 10:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.60
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:25:43.349768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:32:03.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.60",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027no_data_msg\u0027 Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:53:38.269Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf96aa9-2ee7-4411-8f43-3e8d023197bd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/views/all-packages-shortcode.php#L396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/views/all-packages-shortcode.php#L396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/Shortcodes.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/Shortcodes.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/Shortcodes.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/Shortcodes.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3590868%40download-manager\u0026new=3590868%40download-manager\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-29T14:59:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-30T18:55:18.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027no_data_msg\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13733",
"datePublished": "2026-07-01T07:53:38.269Z",
"dateReserved": "2026-06-29T14:43:51.291Z",
"dateUpdated": "2026-07-01T10:32:03.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18586 (GCVE-0-2026-18586)
Vulnerability from cvelistv5 – Published: 2026-10-15 05:30 – Updated: 2026-10-15 16:43
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 10:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T10:45:44.770432Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:43:41.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "thevietronin"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via \u0027order_email\u0027 in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T05:30:21.725Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53bbed98-7874-44dd-9ded-4012250f8aae?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3637473/wpdm-premium-packages/trunk/src/Admin/Order/views/list-orders.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-08-02T20:00:41.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-14T16:34:50.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via \u0027order_email\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18586",
"datePublished": "2026-10-15T05:30:21.725Z",
"dateReserved": "2026-08-02T19:45:25.828Z",
"dateUpdated": "2026-10-15T16:43:41.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103478 (GCVE-0-2026-103478)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:41 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.2.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:11:11.873018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027checkout[billing][phone] (and state / taxid / email)\u0027 parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:41:48.934Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L108"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L115"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L265"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L424"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L190"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724154/wpdm-premium-packages/trunk/templates/dashboard/billing-info.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T16:28:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:08:31.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027checkout[billing][phone]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103478",
"datePublished": "2026-10-10T07:41:48.934Z",
"dateReserved": "2026-09-30T16:13:38.557Z",
"dateUpdated": "2026-10-11T12:13:43.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12054 (GCVE-0-2026-12054)
Vulnerability from cvelistv5 – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Summary
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:14 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.57
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:14:33.892109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:56.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.57",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuvraj Tomar"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027REFERRER\u0027 parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim\u0027s browser."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:31:07.853Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3573804/download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-06T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-06-12T01:31:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T16:40:06.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via \u0027REFERRER\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12054",
"datePublished": "2026-10-10T05:31:07.853Z",
"dateReserved": "2026-06-12T01:15:50.084Z",
"dateUpdated": "2026-10-11T12:23:56.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9696 (GCVE-0-2026-9696)
Vulnerability from cvelistv5 – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.58
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:17:17.469625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:58.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.58",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027not_found\u0027 parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:47.958Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e11e8-de23-469e-9b96-3fc24b03bf98?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=download-manager/tags/3.3.58/src/Package/Shortcodes.php\u0026old=3574454\u0026new_path=download-manager/tags/3.3.59/src/Package/Shortcodes.php\u0026new=3588497"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-05-27T12:06:58.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:57:15.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-9696",
"datePublished": "2026-10-10T04:26:47.958Z",
"dateReserved": "2026-05-27T11:51:14.822Z",
"dateUpdated": "2026-10-11T12:23:58.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103964 (GCVE-0-2026-103964)
Vulnerability from cvelistv5 – Published: 2026-10-10 04:26 – Updated: 2026-10-11 16:55
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Summary
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker's account, which causes the plugin to synchronously compile and send the suspension email inside the administrator's authenticated HTTP request — making the administrator's session cookies available to the template engine at send time.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 16:43 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.71
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T16:43:09.714004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:55:19.438Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.71",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sawyer"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the \u0027first_name\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator\u0027s full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator\u0027s authenticated request, enabling full session hijack and account takeover. Exploitation requires an administrator to perform the Suspend action against the attacker\u0027s account, which causes the plugin to synchronously compile and send the suspension email inside the administrator\u0027s authenticated HTTP request \u2014 making the administrator\u0027s session cookies available to the template engine at send time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:45.587Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84791a83-197b-4a73-826d-517bf47bc5c9?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L533"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L383"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/__/Email.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php#L180"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/UserController.php#L151"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724472/download-manager/trunk/src/__/Email.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T15:51:55.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:29:44.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in \u0027first_name\u0027 Profile Field Token Injection into Suspension Email"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103964",
"datePublished": "2026-10-10T04:26:45.587Z",
"dateReserved": "2026-10-01T15:36:47.334Z",
"dateUpdated": "2026-10-11T16:55:19.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102401 (GCVE-0-2026-102401)
Vulnerability from cvelistv5 – Published: 2026-10-10 04:26 – Updated: 2026-10-11 12:23
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:18 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.71
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:18:00.378166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:59.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.71",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027regurl\u0027 parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only fires for logged-out site visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in(); authenticated users viewing the same page are served a different template and are not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:44.010Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5985b0-0e6c-4dd8-b5f8-53be62adc8dd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/views/login-form.php#L140"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L126"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.71/src/User/Login.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3724472/download-manager/trunk/src/User/views/login-form.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-29T00:31:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:29:40.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027regurl\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-102401",
"datePublished": "2026-10-10T04:26:44.010Z",
"dateReserved": "2026-09-29T00:16:17.679Z",
"dateUpdated": "2026-10-11T12:23:59.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97338 (GCVE-0-2026-97338)
Vulnerability from cvelistv5 – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.70
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:28:57.664357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:48.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.70",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T07:39:28.690Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e04b75d4-9bf5-4b26-ac3a-88a10d200c50?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/Admin/views/stats/history.php#L979"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/User/EditProfile.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L300"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.70/src/__/__.php#L224"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3715131%40download-manager\u0026new=3715131%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-24T12:37:54.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T18:53:39.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-97338",
"datePublished": "2026-10-02T07:39:28.690Z",
"dateReserved": "2026-09-24T12:22:48.989Z",
"dateUpdated": "2026-10-03T15:42:48.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93654 (GCVE-0-2026-93654)
Vulnerability from cvelistv5 – Published: 2026-09-25 07:40 – Updated: 2026-09-25 10:31
VLAI
EPSS
VEX
Title
Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 10:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.2.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T10:31:03.562692Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T10:31:18.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Coopernicus"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027cart_items[][product_name]\u0027 Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:40:25.922Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38e3a2a4-3d35-4de9-9b44-568eab0c44f6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/templates/invoices/default/invoice.php#L167"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/includes/libs/cart-functions.php#L483"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartService.php#L328"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartItem.php#L96"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Order/OrderService.php#L1255"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3708519%40wpdm-premium-packages\u0026new=3708519%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T13:32:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-24T19:07:59.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via \u0027cart_items[][product_name]\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-93654",
"datePublished": "2026-09-25T07:40:25.922Z",
"dateReserved": "2026-09-18T13:17:24.991Z",
"dateUpdated": "2026-09-25T10:31:18.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92714 (GCVE-0-2026-92714)
Vulnerability from cvelistv5 – Published: 2026-09-18 06:38 – Updated: 2026-09-18 11:37
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
Summary
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 11:37 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T11:37:03.587882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T11:37:21.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.68",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pb\u003esec"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic \u0027edit_posts\u0027 capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata \u2014 including protected file references, role-based access restrictions, and password lock settings \u2014 into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:38:52.943Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64cc-75c2-46ba-a086-15a952a20026?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Admin/Menu/Packages.php#L133"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.68/src/Package/PackageController.php#L2425"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3699609%40download-manager\u0026new=3699609%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-16T16:49:44.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T18:30:10.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via \u0027wpdm_duplicate\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-92714",
"datePublished": "2026-09-18T06:38:52.943Z",
"dateReserved": "2026-09-16T16:34:40.641Z",
"dateUpdated": "2026-09-18T11:37:21.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16685 (GCVE-0-2026-16685)
Vulnerability from cvelistv5 – Published: 2026-08-01 07:49 – Updated: 2026-08-03 17:38
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 17:37 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.66
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T17:37:40.845674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:38:14.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.66",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T07:49:48.762Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/__/UI.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.66/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L36"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Package/views/category-shortcode-toolbar.php#L17"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.64/src/Category/Shortcodes.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3628015%40download-manager\u0026new=3628015%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T22:55:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T19:29:43.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027icon\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16685",
"datePublished": "2026-08-01T07:49:48.762Z",
"dateReserved": "2026-07-22T22:39:53.074Z",
"dateUpdated": "2026-08-03T17:38:14.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12800 (GCVE-0-2026-12800)
Vulnerability from cvelistv5 – Published: 2026-07-28 08:34 – Updated: 2026-07-28 13:57
VLAI
EPSS
VEX
Title
Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 13:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 6.2.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T13:57:27.011084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T13:57:37.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "6.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Talal Nasraddeen"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the \u0027code\u0027 parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb-\u003eprepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T08:34:36.797Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/MiniCartAPI.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/6.2.0/includes/libs/CouponCodes.php#L82"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3595291/wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T21:11:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-27T19:51:50.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 6.2.0 - Unauthenticated SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12800",
"datePublished": "2026-07-28T08:34:36.797Z",
"dateReserved": "2026-06-20T19:53:36.643Z",
"dateUpdated": "2026-07-28T13:57:37.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15348 (GCVE-0-2026-15348)
Vulnerability from cvelistv5 – Published: 2026-07-23 09:33 – Updated: 2026-07-23 13:54
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:54 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:54:29.277922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:54:38.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function \u2014 hooked to the unauthenticated WordPress `wp` action \u2014 decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T09:33:56.289Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0183866d-1eab-4982-b62e-77751c7e738c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L637"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L585"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/includes/libs/functions.php#L1811"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/wpdm-premium-packages.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L585"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/includes/libs/functions.php#L1811"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/wpdm-premium-packages.php#L119"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611573%40wpdm-premium-packages\u0026new=3611573%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-09T21:11:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:55:31.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.4 - Authentication Bypass to Non-Admin via \u0027wpdmppdl\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15348",
"datePublished": "2026-07-23T09:33:56.289Z",
"dateReserved": "2026-07-09T20:39:47.692Z",
"dateUpdated": "2026-07-23T13:54:38.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15906 (GCVE-0-2026-15906)
Vulnerability from cvelistv5 – Published: 2026-07-23 08:34 – Updated: 2026-07-23 13:54
VLAI
EPSS
VEX
Title
Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 13:54 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Premium Packages – Sell Digital Products Securely |
Affected:
0 , ≤ 7.0.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T13:54:50.411481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T13:54:59.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Premium Packages \u2013 Sell Digital Products Securely",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "7.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the \u0027orderby\u0027 parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T08:34:40.801Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc6d516-7636-45b2-ade1-c8f2297f0ea1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Admin/Order/views/list-order-renews.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Admin/Order/views/list-order-renews.php#L53"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Admin/Order/views/list-order-renews.php#L51"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.3/src/Order/OrderService.php#L314"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Admin/Order/views/list-order-renews.php#L51"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.0.0/src/Order/OrderService.php#L314"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3611573%40wpdm-premium-packages\u0026new=3611573%40wpdm-premium-packages"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-15T19:02:56.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-22T20:29:48.000Z",
"value": "Disclosed"
}
],
"title": "Premium Packages \u003c= 7.0.4 - Authenticated (Admin+) SQL Injection via \u0027orderby\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15906",
"datePublished": "2026-07-23T08:34:40.801Z",
"dateReserved": "2026-07-15T18:47:23.077Z",
"dateUpdated": "2026-07-23T13:54:59.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14343 (GCVE-0-2026-14343)
Vulnerability from cvelistv5 – Published: 2026-07-09 06:52 – Updated: 2026-07-09 17:31
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 17:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.61
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T17:31:04.036777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:31:10.016Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.61",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027note_before\u0027 and \u0027note_after\u0027 Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T06:52:45.773Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74cd34be-008c-4ff3-ae3c-417cfd2fee9b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php#L69"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/views/reg-form.php#L78"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php#L123"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.61/src/User/Register.php#L32"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3594267%40download-manager\u0026new=3594267%40download-manager"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-01T14:41:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-08T18:12:21.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027note_before\u0027 and \u0027note_after\u0027 Shortcode Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14343",
"datePublished": "2026-07-09T06:52:45.773Z",
"dateReserved": "2026-07-01T14:26:42.757Z",
"dateUpdated": "2026-07-09T17:31:10.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13733 (GCVE-0-2026-13733)
Vulnerability from cvelistv5 – Published: 2026-07-01 07:53 – Updated: 2026-07-01 10:32
VLAI
EPSS
VEX
Title
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Summary
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 10:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| codename065 | Download Manager |
Affected:
0 , ≤ 3.3.60
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13733",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T10:25:43.349768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T10:32:03.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Download Manager",
"vendor": "codename065",
"versions": [
{
"lessThanOrEqual": "3.3.60",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027no_data_msg\u0027 Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:53:38.269Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf96aa9-2ee7-4411-8f43-3e8d023197bd?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/views/all-packages-shortcode.php#L396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/views/all-packages-shortcode.php#L396"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/Shortcodes.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.60/src/Package/Shortcodes.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/Shortcodes.php#L398"
},
{
"url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.59/src/Package/Shortcodes.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3590868%40download-manager\u0026new=3590868%40download-manager\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-29T14:59:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-30T18:55:18.000Z",
"value": "Disclosed"
}
],
"title": "Download Manager \u003c= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027no_data_msg\u0027 Shortcode Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13733",
"datePublished": "2026-07-01T07:53:38.269Z",
"dateReserved": "2026-06-29T14:43:51.291Z",
"dateUpdated": "2026-07-01T10:32:03.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}