Vulnerability history

Subscriber+ Guest Order Takeover vulnerability

Unauthenticated Guest Order Status Disclosure vulnerability

Unauthenticated Cross-User Saved Cart Disclosure vulnerability

Unauthenticated Order Total Manipulation vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated PayPal Webhook Signature Verification Bypass vulnerability

WordPress Premium Packages - Sell Digital Products Securely plugin < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated SQL Injection vulnerability

Authentication Bypass to Non-Admin vulnerability

Authenticated (Admin+) SQL Injection vulnerability

SQL Injection vulnerability

Broken Access Control vulnerability

Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Scripting (XSS) Vulnerability

SQL Injection vulnerability

Reflected Cross-Site Scripting via add_query_arg vulnerability

WordPress Premium Packages - Sell Digital Products Securely plugin <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode vulnerability

SQL Injection vulnerability

Cross-Site Request Forgery vulnerability

Cross Site Scripting (XSS) vulnerability

Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation vulnerability