Shahjada
Monthly
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers can bypass access controls in Shahjada Download Manager through version 3.3.52, gaining unauthorized read access to restricted download content due to missing authorization checks. The vulnerability affects all versions up to and including 3.3.52, with an EPSS exploitation probability of 0.02% (4th percentile) indicating minimal real-world risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed.
Stored XSS in Shahjada Download Manager WordPress plugin versions up to 3.3.53 allows authenticated administrators with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (UI:R) and high administrative privileges (PR:H), limiting real-world attack surface; EPSS exploitation probability is exceptionally low at 0.03% (8th percentile), indicating minimal practical risk despite the stored nature of the vulnerability.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers can bypass access controls in Shahjada Download Manager through version 3.3.52, gaining unauthorized read access to restricted download content due to missing authorization checks. The vulnerability affects all versions up to and including 3.3.52, with an EPSS exploitation probability of 0.02% (4th percentile) indicating minimal real-world risk despite the network-accessible attack vector. No public exploit code or active exploitation has been confirmed.
Stored XSS in Shahjada Download Manager WordPress plugin versions up to 3.3.53 allows authenticated administrators with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (UI:R) and high administrative privileges (PR:H), limiting real-world attack surface; EPSS exploitation probability is exceptionally low at 0.03% (8th percentile), indicating minimal practical risk despite the stored nature of the vulnerability.