Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 19

Reset filters

Medium 09.10.2026

CVE-2026-103478

Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter

The Premium Packages plugin for WordPress is vulnerable to stored cross-site scripting via checkout billing parameters. Authenticated attackers with subscriber-level access can inject malicious scripts that execute in the context of users viewing the affected pages.

High 24.09.2026

CVE-2026-93654

Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

Medium 21.09.2026

CVE-2026-93511

Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events

Medium 20.08.2026

CVE-2026-19711

Premium Packages – Sell Digital Products Securely < 7.0.7 - Authenticated (Subscriber+) Payment Bypass

High 18.08.2026

CVE-2026-73190

Premium Packages – Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting

High 27.07.2026

CVE-2026-12800

Premium Packages <= 6.2.0 - Unauthenticated SQL Injection

Medium 22.07.2026

CVE-2026-15348

Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter

Medium 22.07.2026

CVE-2026-15906

Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter

High 16.07.2026

CVE-2026-61948

Premium Packages – Sell Digital Products Securely <= 6.2.0 - Unauthenticated SQL Injection

Medium 16.07.2026

CVE-2026-61943

Premium Packages – Sell Digital Products Securely <= 6.2.0 - Missing Authorization

Medium 14.08.2025

CVE-2025-54732

WPDM – Premium Packages <= 6.0.2 - Cross-Site Request Forgery

Medium 05.06.2025

CVE-2025-30991

Premium Packages <= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium 24.01.2025

CVE-2025-24659

Premium Packages <= 5.9.6 - Authenticated (Administrator+) SQL Injection

Medium 21.11.2024

CVE-2024-11225

Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg

Medium 20.11.2024

CVE-2024-10164

Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode

Medium 15.11.2024

CVE-2024-52435

Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection

Medium 24.09.2024

CVE-2024-7386

Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery

Medium 25.03.2024

CVE-2024-29924

Premium Packages <= 5.8.2 - Reflected Cross-Site Scripting

High 11.08.2023

CVE-2023-4293

Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 19

Know which vulnerabilities affect your application

Application security in your inbox