CO
Vendor
codename065
29
CVEs
0
On KEV
8
New 30D
Products
DM8.8
Download Manager
codename065
22 CVEs0 on KEV5 new
PP7.5
Premium Packages – Sell Digital Products Securely
codename065
7 CVEs0 on KEV3 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110664 | PP Premium Packages – Sell Digital Products Securely codename065 | 6.4 | Oct 16 | Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes |
| CVE-2026-18586 | PP Premium Packages – Sell Digital Products Securely codename065 | 7.2 | Oct 15 | Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' |
| CVE-2026-103478 | PP Premium Packages – Sell Digital Products Securely codename065 | 6.4 | Oct 10 | Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter |
| CVE-2026-12054 | DM Download Manager codename065 | 6.1 | Oct 10 | Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter |
| CVE-2026-9696 | DM Download Manager codename065 | 6.4 | Oct 10 | Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode |
| CVE-2026-103964 | DM Download Manager codename065 | 4.3 | Oct 10 | Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email |
| CVE-2026-102401 | DM Download Manager codename065 | 6.4 | Oct 10 | Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute |
| CVE-2026-97338 | DM Download Manager codename065 | 6.4 | Oct 2 | Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name |
| CVE-2026-93654 | PP Premium Packages – Sell Digital Products Securely codename065 | 7.2 | Sep 25 | Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter |
| CVE-2026-92714 | DM Download Manager codename065 | 6.5 | Sep 18 | Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter |
| CVE-2026-16685 | DM Download Manager codename065 | 6.4 | Aug 1 | Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute |
| CVE-2026-12800 | PP Premium Packages – Sell Digital Products Securely codename065 | 7.5 | Jul 28 | Premium Packages <= 6.2.0 - Unauthenticated SQL Injection |
| CVE-2026-15348 | PP Premium Packages – Sell Digital Products Securely codename065 | 6.3 | Jul 23 | Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter |
| CVE-2026-15906 | PP Premium Packages – Sell Digital Products Securely codename065 | 6.5 | Jul 23 | Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter |
| CVE-2026-14343 | DM Download Manager codename065 | 6.4 | Jul 9 | Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes |
| CVE-2026-13733 | DM Download Manager codename065 | 6.4 | Jul 1 | Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute |
| CVE-2026-4057 | DM Download Manager codename065 | 4.3 | Apr 10 | Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal |
| CVE-2026-5357 | DM Download Manager codename065 | 6.4 | Apr 9 | Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
| CVE-2026-2571 | DM Download Manager codename065 | 4.3 | Mar 19 | Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter |
| CVE-2026-1666 | DM Download Manager codename065 | 6.1 | Feb 18 | Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter |
| CVE-2025-15364 | DM Download Manager codename065 | 7.3 | Jan 6 | Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword |
| CVE-2025-13498 | DM Download Manager codename065 | 4.3 | Dec 18 | Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure |
| CVE-2025-12177 | DM Download Manager codename065 | 5.3 | Nov 8 | Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key |
| CVE-2025-10146 | DM Download Manager codename065 | 6.1 | Sep 19 | Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter |
| CVE-2025-4367 | DM Download Manager codename065 | 5.4 | Jun 19 | Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode |
| CVE-2025-3404 | DM Download Manager codename065 | 8.8 | Apr 19 | Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion |
| CVE-2025-3056 | DM Download Manager codename065 | 5.4 | Apr 18 | Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
| CVE-2024-11768 | DM Download Manager codename065 | 5.3 | Dec 19 | Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files |
| CVE-2024-11740 | DM Download Manager codename065 | 7.3 | Dec 19 | Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution |