Sell Downloads

Sell Downloads has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Improper Input Validation, Path Traversal.

Every one of the 4 issues recorded for Sell Downloads has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Sell Downloads is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Sell Downloads vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2015-9348

Sell Downloads <= 1.0.7 - Improper Input Validation

Read the full analysis

Vulnerability Records

4 records
Sell Downloads banner
Latestv1.2.4

Sell Downloads

codepeople

Author

codepeople

4.0(21)
80/100
Last Updated
2026-09-16 (1mo ago)
Active Installs
100+
Downloads
97,843
Requires WP
3.5.0+
Requires PHP
0+
Tested up to
WP 7.1.3
Created
2013-03-20 (14y ago)

Sell Downloads is a WordPress eCommerce plugin designed specifically for selling digital products. Create an online store for audio, video, documents, images, books, software, and other downloadable files without the shipping, inventory, and product-management settings normally associated with physical products. The plugin provides tools to organize and display digital products, manage purchases, protect downloadable files, create promotions, and track sales. Products can be filtered and sorted by different criteria, displayed using different store layouts, and inserted individually or as product lists into WordPress pages and posts. Main features: Sell downloadable audio, video, documents, images, and other digital files. Accept payments through PayPal. Filter products by file type. Display products using different store layouts. Paginate products and sort them by popularity, price, name, or publication date. Insert individual products or complete product lists into WordPress pages and posts. Add descriptions, images, publication year, duration, file type, and additional information to products. Provide demo files that visitors can access before purchasing. Protect purchased files through server-side download validation. Set download expiration periods and download limits. Share products through social networks. Track sales and review reports by period, currency, country, or product. Store and product display The store can be configured to match the needs of the website. Products can be filtered by type, displayed in multiple columns, paginated, and sorted according to different criteria. Individual products can also be inserted directly into pages or posts. The plugin integrates with: Classic WordPress Editor Gutenberg Editor Elementor Page Builder by SiteOrigin Beaver Builder For other editors, the generated shortcodes can be inserted using their HTML or shortcode controls. Basic Sell Downloads installation and usage. Sales statistics The sales reports module allows store managers to review purchases over a selected period. Reports include sales totals and can be analyzed by currency, country, or product. Sales reports can also be deleted when necessary, for example after a refund, to keep the statistics consistent with the actual sales. Premium features The premium version adds features for stores that need more advanced sales and promotion tools: Shopping cart for purchasing multiple products in a single transaction. Product widget for displaying individual products in sidebars. Product-list widget and shortcode for displaying the most rated, newest, or top-selling products. Sales discounts with configurable dates, promotional text, and discounted prices. Discount coupons that can be applied to store purchases. Additional product and product-list insertion options. Premium Sell Downloads features. Premium version demo https://demos.dwbooster.com/sell-downloads/wp-login.php https://demos.dwbooster.com/sell-downloads/ Download security Purchased files are not intended to be accessed directly from their URLs. Sell Downloads stores purchased files in the sd-downloads directory and uses server-side validation when processing download requests. The download settings can be configured to: Limit the period during which a download link remains valid. Limit the number of downloads allowed for a purchase. Request the purchaser’s email address before allowing a download. These mechanisms help control access to purchased files, although the overall security of a website also depends on its server and WordPress configuration. More information http://wordpress.dwbooster.com/content-tools/sell-downloads Inserting products and product lists into pages and sidebars. Interface Store settings Configure the store through Sell Downloads > Sell Downloads Settings. The settings include the store page, product filtering, layout, pagination, social sharing, payment options, download security, discounts, coupons, and notification emails. General settings URL of store page: URL of the page containing the store. Allow searching by taxonomies: Allows WordPress searches to find products through their taxonomies. Allow to filter by type: Adds a product-type filter to the store. Store layout: Selects the store layout. Allow multiple pages: Enables pagination. Items per page: Defines the number of products displayed per page. Share in social networks: Displays social sharing buttons. Facebook app ID: Facebook application ID used for sharing. Payment gateway Sell Downloads uses PayPal for processing payments. Enable PayPal Payments: Enables PayPal sales. PayPal email: Email address associated with the PayPal account. Currency: Currency used for payments. PayPal language: Language of the PayPal interface. PayPal button: Selects the PayPal button design. Increase the download page security: Requests the purchaser’s email address before providing the download. Download link valid for: Defines the expiration period for download links. Discounts and coupons Premium versions can define store-wide discounts and coupons with configurable percentages, minimum purchase amounts, validity dates, and promotional text. Notifications The notification settings control emails sent to customers and store administrators. Notification “from” email: Sender address. Send notification to email: Administrator notification address. Subject of user confirmation email: Subject sent to the customer. Email confirmation to user: Customer email body. The %INFORMATION% tag is replaced with purchase information such as download links. Subject of email notification to admin: Administrator notification subject. Email notification to admin: Administrator notification body. The %INFORMATION% tag is replaced with purchase information. Affiliate Royale integration Sell Downloads can integrate with the Affiliate Royale plugin when it is installed on the website. Creating products Go to Sell Downloads > Products for Sale to manage products. Select Add New to create a product. Each product can include: Title: Product name displayed in the store and product page. Description: Additional information displayed on the product page. Sales Price: Product price. File for sale: Downloadable file selected from the WordPress media library. File for demo: Optional demo file accessible before purchase. File Type: Product type used for filtering. Image: Image representing the product. Duration: Duration for audio or video files. Publication Year: Publication or creation year. Additional Information: URL containing additional product information. Premium versions can also define product-specific discounts with a new price, validity dates, and promotional text. Publishing the store Insert the store into a WordPress page or post using the Sell Downloads insertion controls. The plugin generates the corresponding shortcode. The insertion interface includes options such as: Filter results by product type: Displays only products of the selected type. Columns: Defines the number of columns used by the store. After creating the store page, its URL can be entered in the plugin settings so visitors can return to the store from individual product pages. Store shortcode attributes The [sell_downloads] shortcode supports attributes for controlling the store display. columns defines the number of columns: [sell_downloads columns="3"] filter_by_type accepts `1` or `0` and enables or disables product-type filtering: [sell_downloads columns="3" filter_by_type="1"] show_order_by accepts `1` or `0` and enables or disables the ordering controls: [sell_downloads columns="3" show_order_by="1"] order_by defines the sorting criterion. Supported values include `plays`, `price`, `post_title`, and `post_date`: [sell_downloads columns="3" order_by="post_title"] Inserting an individual product Premium versions allow individual products to be inserted into pages or posts by entering the product ID. The product can also be displayed through the corresponding widget. Inserting a product list Premium versions allow product lists to be inserted into pages, posts, and sidebars. The list can display: Top-rated products. Newest products. Top-selling products. The insertion interface allows the number of products and columns to be configured.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C