Wpdownloadmanager Premium Packages Sell Digital Products Securely vulnerabilities

3 vulnerabilities

Known vulnerabilities in Wpdownloadmanager Premium Packages Sell Digital Products Securely, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.6CVE-2024-52435shahjadawpdm – premium packages+2
EPSS score
0.46%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.5.4.3CVE-2024-7386codename065premium packages – sell digital products securely+2
EPSS score
0.18%
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.8.8CVE-2023-4293codename065premium packages – sell digital products securely+2
EPSS score
0.99%
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.