CVE-2025-24659

WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WordPress Download Manager Premium Packages allows Blind SQL Injection. This issue affects Premium Packages: from n/a through 5.9.6.

Affected

Shahjada · WPDM – Premium Packages

CVSS v3.1 PATCHSTACK

7.6 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

EPSS

0.97% chance of exploitation in the next 30 days, 61st percentile

Published

2025-01-24

Updated

2026-04-28

Proof-of-concept exploits (1)

• DoTTak/CVE-2025-246591★ · 2025-01-31

References

• CVE Record
• NVD entry

Related

• CVE-2024-56278
• CVE-2024-56289
• CVE-2025-22352
• CVE-2025-22510
• CVE-2025-22652
• CVE-2025-22710