Premium Packages – Sell Digital Products Securely vulnerabilities

Product

Premium Packages – Sell Digital Products Securely

by codename065 · last CVE Oct 16, 2026

CVEs

On KEV

7.5

Max CVSS

New 30D

Severity mix

Critical 0High 3Medium 4Low 0

Severity

Exploitation

Watch

Add Premium Packages – Sell Digital Products Securely to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-12800	7.5	2%	Jul 28	Premium Packages <= 6.2.0 - Unauthenticated SQL Injection Affected: through 6.2.0
CVE-2026-18586	7.2	0%	Oct 15	Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' Affected: through 7.0.5
CVE-2026-93654	7.2	0%	Sep 25	Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter Affected: through 7.2.1
CVE-2026-15906	6.5	0%	Jul 23	Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter Affected: through 7.0.4
CVE-2026-110664	6.4	0%	Oct 16	Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes Affected: through 7.2.8
CVE-2026-103478	6.4	0%	Oct 10	Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter Affected: through 7.2.6
CVE-2026-15348	6.3	1%	Jul 23	Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter Affected: through 7.0.4