Premium Packages – Sell Digital Products Securely vulnerabilities

Product

Premium Packages – Sell Digital Products Securely

by codename065 · last CVE Oct 16, 2026

CVEs

On KEV

7.5

Max CVSS

New 30D

Vulnerabilities11 In the news0 Timeline

Severity mix

Critical 0High 3Medium 8Low 0

Severity

All severities11 Critical0 High3 Medium8 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Premium Packages – Sell Digital Products Securely to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-12800	7.5	2%	Jul 28	Premium Packages <= 6.2.0 - Unauthenticated SQL Injection Affected: through 6.2.0
CVE-2026-18586	7.2	0%	Oct 15	Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' Affected: through 7.0.5
CVE-2026-93654	7.2	0%	Sep 25	Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter Affected: through 7.2.1
CVE-2026-15906	6.5	0%	Jul 23	Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter Affected: through 7.0.4
CVE-2023-4293	6.5	1%	Aug 12	Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation Affected: through 5.7.4
CVE-2026-110664	6.4	0%	Oct 16	Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes Affected: through 7.2.8
CVE-2026-103478	6.4	0%	Oct 10	Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter Affected: through 7.2.6
CVE-2024-10164	6.4	1%	Nov 21	Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode Affected: through 5.9.3
CVE-2026-15348	6.3	1%	Jul 23	Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter Affected: through 7.0.4
CVE-2024-11225	6.1	1%	Nov 22	Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg Affected: through 5.9.3
CVE-2024-7386	4.3	0%	Sep 25	Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery Affected: through 5.9.1