توضیحات
This File Management & Digital Store plugin will help you to control file downloads & sell digital products from your WP site.
تغییرات این نسخه
3.3.68 – 2026.08.20
Improved: Redesigned the activity report email with a clearer hierarchy – the headline figure now leads each section, metric cards share a common baseline, and every section carries a designed empty state so a quiet period still reads as intentional
Improved: Activity report tables now expose proper column headers to screen readers, and layout tables are marked as presentational
Security: Unauthenticated password-protection bypass via PHP type juggling – the package password check ( validate-password REST endpoint ) used a loose comparison, so a download protected with an all-numeric password could be unlocked by submitting an equivalent numeric string ( e.g. “1.23e2” in place of “123” ) without knowing the real password; the check now uses a strict, timing-safe comparison ( Reported by Shikhali Jamalzade )
Security: Missing Authorization on the public profile menu endpoint ( wpdm_get_profile_menu_content ) let unauthenticated visitors read any registered user’s favourites list by passing an arbitrary user id; the profile owner id is now bound into the signed request token and the handler validates the requested menu, so profile content can only be loaded through a genuine public profile page ( Reported by Harsh Sanghvi )
3.3.67 – 2026.07.30
Security: Contributor+ Stored Cross-Site Scripting via the icon and icon_width attributes of the [wpdm_category] shortcode – the attribute values were interpolated into the image tag unescaped and could break out
Improved: Redesigned the activity report email with a clearer hierarchy – the headline figure now leads each section, metric cards share a common baseline, and every section carries a designed empty state so a quiet period still reads as intentional
Improved: Activity report tables now expose proper column headers to screen readers, and layout tables are marked as presentational
Security: Unauthenticated password-protection bypass via PHP type juggling – the package password check ( validate-password REST endpoint ) used a loose comparison, so a download protected with an all-numeric password could be unlocked by submitting an equivalent numeric string ( e.g. “1.23e2” in place of “123” ) without knowing the real password; the check now uses a strict, timing-safe comparison ( Reported by Shikhali Jamalzade )
Security: Missing Authorization on the public profile menu endpoint ( wpdm_get_profile_menu_content ) let unauthenticated visitors read any registered user’s favourites list by passing an arbitrary user id; the profile owner id is now bound into the signed request token and the handler validates the requested menu, so profile content can only be loaded through a genuine public profile page ( Reported by Harsh Sanghvi )
3.3.67 – 2026.07.30
Security: Contributor+ Stored Cross-Site Scripting via the icon and icon_width attributes of the [wpdm_category] shortcode – the attribute values were interpolated into the image tag unescaped and could break out