WordPress plugin
Premium Packages – Sell Digital Products Securely security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 25 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High6
- Medium19
- Low0
All Premium Packages – Sell Digital Products Securely vulnerabilities
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<7.3.1Update to 7.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
<7.3.1Update to 7.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
<7.3.1Update to 7.3.1
- Medium5.3Missing Authorization
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
≤7.2.8Update to 7.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'order_email'
≤7.0.5Update to 7.0.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
≤7.2.6Update to 7.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
≤7.2.1Update to 7.2.2
- Medium5.3Unauthenticated Forged Payment and Subscription Events
≤7.2.0Update to 7.2.1
- Medium4.3Authenticated (Subscriber+) Payment Bypass
<7.0.7Update to 7.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.0.5Update to 7.0.6
- High7.5Unauthenticated SQL Injection
≤6.2.0Update to 7.0.0
- Medium6.3Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
≤7.0.4Update to 7.0.5
- Medium6.5Authenticated (Admin+) SQL Injection via 'orderby' Parameter
≤7.0.4Update to 7.0.5
- High7.5Unauthenticated SQL Injection
≤6.2.0Update to 7.0.0
- Medium5.3Missing Authorization
≤6.2.0Update to 7.0.0
- Medium4.3Cross-Site Request Forgery
≤6.0.2Update to 6.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤6.0.5Update to 6.0.7
- Medium4.9Authenticated (Administrator+) SQL Injection
≤5.9.6Update to 5.9.7
- Medium6.1Reflected Cross-Site Scripting via add_query_arg
≤5.9.3Update to 5.9.4
- Medium6.4Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode
≤5.9.3Update to 5.9.4
- Medium4.9Authenticated (Administrator+) SQL Injection
≤6.0.5Update to 6.0.6
- Medium4.3Cross-Site Request Forgery
≤5.9.1Update to 5.9.2
- Medium6.1Reflected Cross-Site Scripting
≤5.8.2Update to 5.8.3
- High8.8Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation
≤5.7.4Update to 5.7.5
Premium Packages – Sell Digital Products Securely: common questions
Does Premium Packages – Sell Digital Products Securely have known vulnerabilities?
Yes. VulnCrest Radar lists 25 known vulnerabilities in Premium Packages – Sell Digital Products Securely: 6 high, 19 medium. None are known to affect version null.
How do I check which version of Premium Packages – Sell Digital Products Securely I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Premium Packages – Sell Digital Products Securely vulnerability?
CVE-2026-118407, published Nov 4, 2026: Premium Packages – Sell Digital Products Securely < 7.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Premium Packages – Sell Digital Products Securely vulnerability listed in CISA KEV?
No. None of the known Premium Packages – Sell Digital Products Securely vulnerabilities is currently listed in the CISA KEV catalog.