The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses tag-based filtering because the payload is stored as a hex-escaped sequence (e.g., \x3cimg onerror=...\x3e) that sanitize_textarea_field does not strip, and is only decoded back into a live HTML tag by stripcslashes() during admin rendering — after all sanitization has occurred.
The Premium Packages – Sell Digital Products Securely WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability in the 'order_email' parameter. This affects all versions up to and including 7.0.5. The vulnerability arises from insufficient input sanitization and output escaping, allowing attackers to inject malicious scripts that execute when users view the affected pages.
The Premium Packages – Sell Digital Products Securely WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'checkout[billing][phone]' parameter and related fields. This vulnerability exists in all versions up to and including 7.2.6 and allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Download Manager plugin for WordPress, developed by codename065, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the 'REFERRER' parameter. This vulnerability exists in all versions up to and including 3.3.57 due to insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this flaw to inject arbitrary scripts that execute in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity level.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'not_found' parameter. This vulnerability affects all versions up to and including 3.3.58. Authenticated users with Contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Download Manager plugin for WordPress up to version 3.3.71 contains a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator session cookies via the 'first_name' parameter. This occurs when an administrator suspends the attacker's account, triggering a suspension email that includes the administrator's full Cookie header, enabling session hijacking and potential account takeover.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'regurl' parameter affecting all versions up to and including 3.3.71. Authenticated users with contributor-level access or higher can inject malicious scripts that execute for logged-out visitors viewing the injected pages. The vulnerability arises from insufficient input sanitization and output escaping. The injected payload does not affect authenticated users due to template gating based on login status.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the display name field. This affects all versions up to and including 3.3.70. Authenticated users with subscriber-level access or higher can inject malicious scripts via the display name when the [wpdm_edit_profile] shortcode is present on a front-end page. The vulnerability arises from insufficient input sanitization and output escaping, allowing arbitrary script execution when other users access the injected page.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce (NONCE_KEY) without any object-level authorization check against the targeted wpdmpro package ID. This makes it possible for authenticated attackers, with Author-level access and above, to duplicate arbitrary Download Manager packages owned by other users (including administrators), which copies all package metadata — including protected file references, role-based access restrictions, and password lock settings — into an attacker-owned clone that they can then edit to remove restrictions and download the previously protected files.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() does not neutralize the payload because it operates on post content at save time and does not process shortcode attribute values that are emitted unescaped at render time.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticated WordPress `wp` action — decoding the attacker-controlled `wpdmppdl` parameter using only `base64_decode()` and `json_decode()` with no HMAC, cryptographic signature, or nonce verification, and then issuing WordPress authentication cookies after a domain check that is trivially bypassed because both sides of the comparison are attacker-supplied values. This makes it possible for unauthenticated attackers to authenticate as any non-administrator WordPress user, including subscribers, customers, contributors, authors, editors, and shop managers, who owns an order, gaining full session-level access to that account.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.
The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to strip all protection metadata (password, access restrictions, private flag) from any media file they do not own, making admin-protected files publicly accessible via their direct URL.
CVE-2026-5357 is a stored cross-site scripting (XSS) vulnerability in the codename065 Download Manager WordPress plugin up to version 3.3.52. It arises from improper sanitization and escaping of the 'sid' parameter in the 'wpdm_members' shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected page. The vulnerability has a CVSS score of 6.4, indicating a medium severity risk. No official patch or remediation guidance is currently available from the vendor.
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.