C
Vendor security profile
codename065
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
2
6
CVE KEV
CVE severity distribution
9toplam CVE
High1 (11%)
Medium8 (89%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
6.4
CVE-2026-103478
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
C
Patch status unknownEPSS %0
6.1
CVE-2026-12054
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
C
Patch status unknownEPSS %0
6.4
CVE-2026-9696
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
C
Patch status unknownEPSS %0
4.3
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
C
Patch status unknownEPSS %0
6.4
CVE-2026-102401
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
C
Patch status unknownEPSS %0
6.4
CVE-2026-97338
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
C
Patch status unknownEPSS %0
7.2
CVE-2026-93654
Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
C
Patch status unknownEPSS %0
6.5
CVE-2026-92714
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
C
Patch status unknownEPSS %0
6.4
CVE-2026-16685
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
C
Patch status unknownEPSS %0