These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a [truncated]
The Premium Packages – Sell Digital Products Securely plugin for WordPress has a vulnerability to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute when a user accesses an injected page.
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone]' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that w [truncated]
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that can execute in a victim's browser, potentially leading to unauthorized actions or data breaches [truncated]
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the adminis [truncated]
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access to inject arbitrary web scripts, which are executed when a logged-out site visitor accesses an affected page. [truncated]
The Download Manager plugin for WordPress has a Stored Cross-Site Scripting vulnerability via Display Name in all versions up to, and including, 3.3.70. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute when a user accesses an injected page. The vulnerability requires the wpdm_edit_profile shortcode to be present on a fron [truncated]
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cart_items[][product_name]' parameter in all versions up to, and including, 7.2.1. This allows unauthenticated attackers to inject arbitrary web scripts, which execute when a user accesses an injected page. The vulnerability exists due to insufficient input sanitization and outp [truncated]
The Download Manager plugin for WordPress has a vulnerability allowing authenticated attackers with Author-level access to duplicate arbitrary packages owned by other users, potentially exposing protected files. This vulnerability requires verification of affected versions and exposure to prioritize remediation efforts. The vulnerability is caused by insufficient object-level authorization in the duplicat [truncated]
The Download Manager plugin for WordPress has a privilege escalation vulnerability via account takeover in all versions up to, and including, 3.3.40. This is due to improper validation of a user's identity prior to updating their details like password. Unauthenticated attackers can change user passwords, except administrators, to gain access to their accounts.
