Skip to content
PluginCanary

Premium Packages

Premium Packages - Sell Digital Products Securely
by Shahjada · 2,000+ active installs · Checked 5 Nov 2026
Healthy

Healthy: maintained, last release 4 Nov 2026, 46 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Premium Packages
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Premium Packages still maintained?
Yes. Last release 4 Nov 2026, 46 releases in the last 24 months. 4 Nov 2026 · wordpress.org
Who owns Premium Packages, and has it changed hands?
No change recorded. Main committer codename065 since May 2018. 5 Nov 2026 · SVN log
Was Premium Packages removed from wordpress.org?
No. Listed on wordpress.org as of 5 Nov 2026. 5 Nov 2026 · wordpress.org
Is Premium Packages safe?
22 known vulnerabilities, all fixed (latest in 7.2.2). Not on the exploited list. 29 Oct 2026 · Wordfence Intelligence
Is the latest Premium Packages update safe to install?
No ownership change before 7.3.3. No one-star spike after it. 4 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
codename06514 May 2018 to 4 Nov 2026, 397 commits

1 committer recorded. No ownership change since 2018.

Maintenance

Last release
yesterday
Releases, 24 months
46
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Premium Packages
Q1 20242
Q2 20243
Q3 20245
Q4 20245
Q1 20252
Q2 20253
Q3 20254
Q4 20257
Q1 20261
Q2 20260
Q3 202619
Q4 20266

Last release 4 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 3.8.

Rating distribution
5 star2
4 star1
3 star0
2 star0
1 star1

Security record

19 vulnerabilities in 24 months (22 on record), all patched (latest fixed in 7.2.2).

Show 22 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
29 Oct 2026Premium Packages <= 7.2.1 - Missing Authorization5.3<= 7.2.17.2.2Patched before disclosure
15 Oct 2026Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes6.4<= 7.2.87.3.0Patched before disclosure
14 Oct 2026Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'7.2<= 7.0.57.0.6Patched before disclosure
9 Oct 2026Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter6.4<= 7.2.67.2.7Patched before disclosure
24 Sep 2026Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter7.2<= 7.2.17.2.2Patched before disclosure
21 Sep 2026Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events5.3<= 7.2.07.2.1Patched before disclosure
20 Aug 2026Premium Packages - Sell Digital Products Securely < 7.0.7 - Authenticated (Subscriber+) Payment Bypass4.3< 7.0.77.0.7Patched before disclosure
18 Aug 2026Premium Packages - Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 7.0.57.0.6Patched before disclosure
27 Jul 2026Premium Packages <= 6.2.0 - Unauthenticated SQL Injection7.5<= 6.2.07.0.0Patched before disclosure
22 Jul 2026Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter6.3<= 7.0.47.0.5Patched before disclosure
22 Jul 2026Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter6.5<= 7.0.47.0.5Patched before disclosure
16 Jul 2026Premium Packages - Sell Digital Products Securely <= 6.2.0 - Unauthenticated SQL Injection7.5<= 6.2.07.0.0Patched before disclosure
16 Jul 2026Premium Packages - Sell Digital Products Securely <= 6.2.0 - Missing Authorization5.3<= 6.2.07.0.0Patched before disclosure
14 Aug 2025WPDM - Premium Packages <= 6.0.2 - Cross-Site Request Forgery4.3<= 6.0.26.0.3Patched before disclosure
5 Jun 2025Premium Packages <= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.0.56.0.7123
24 Jan 2025Premium Packages <= 5.9.6 - Authenticated (Administrator+) SQL Injection4.9<= 5.9.65.9.7Patched before disclosure
21 Nov 2024Premium Packages - Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg6.1<= 5.9.35.9.4Patched before disclosure
20 Nov 2024Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode6.4<= 5.9.35.9.4Patched before disclosure
15 Nov 2024Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection4.9<= 6.0.56.0.6293
24 Sep 2024Premium Packages - Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery4.3<= 5.9.15.9.2Patched before disclosure
25 Mar 2024Premium Packages <= 5.8.2 - Reflected Cross-Site Scripting6.1<= 5.8.25.8.3Patched before disclosure
11 Aug 2023Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation8.8<= 5.7.45.7.5Patched before disclosure

Changelog mentions of security fixes: 7.0.0 (security); 7.0.5 (security, SQL injection); 7.0.6 (security, XSS, escaping); 7.0.7 (security, nonce); 7.0.9 (security, nonce, sanitize).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Premium Packages
4 May 202681
11 May 2026270
18 May 2026188
25 May 2026180
1 Jun 2026153
8 Jun 2026173
15 Jun 2026151
22 Jun 2026126
29 Jun 20261,230
6 Jul 20261,858
13 Jul 20261,742
20 Jul 2026751
27 Jul 2026425
3 Aug 20262,330
10 Aug 20262,645
17 Aug 2026637
24 Aug 2026365
31 Aug 20261,863
7 Sep 20261,997
14 Sep 2026554
21 Sep 20264,051
28 Sep 20262,188
5 Oct 20261,858
12 Oct 20261,792
19 Oct 2026758
26 Oct 20262,427
2 Nov 2026117

Weekly downloads over the last 4 weeks are 11% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version7.3.3
AuthorShahjada
Added14 May 2018
Last updated4 Nov 2026
Active installs2,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHPnot stated
CategoryE-commerce & Shopping
Tagsecommerce, shopping cart, wordpress store, digital downloads, sell digital products

Other plugins by this author: Download Manager, Download Manager Addons for Elementor, Editor Blocks by Download Manager, WP Tabular - HTML Table Generator for WordPress, Visitor Stats Widget

Questions

Is Premium Packages still maintained?

Yes. Last release 4 Nov 2026, 46 releases in the last 24 months.

Who owns Premium Packages, and has it changed hands?

No change recorded. Main committer codename065 since May 2018.

Was Premium Packages removed from wordpress.org?

No. Listed on wordpress.org as of 5 Nov 2026.

Is Premium Packages safe?

22 known vulnerabilities, all fixed (latest in 7.2.2). Not on the exploited list.

Is the latest Premium Packages update safe to install?

No ownership change before 7.3.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 5 Nov 2026.Report a data issue