Every recorded version, newest first, with what changed in each one.
Latest 7.4.08 versions
Undated · 8 versions
7.4.0
Latest
1 fix2 security3 changes
Fixed
Fixed an unauthenticated blind SQL injection vulnerability (CWE-89). The internal temporary-storage lookup interpolated a request-derived key directly into a database query; sanitize_text_field does not escape SQL quotes, so several unauthenticated entry points (including the media download handler via __mediakey ) could be abused for time-based blind injection.
Security release — version 7.4.0. All users are strongly advised to update immediately.
Changes
The query is now fully parameterized with $wpdb->prepare , closing the injection for every caller of the storage layer.
Credit: responsibly disclosed by mrinolife .
May 26, 2026
7.3.9
2 new9 changes
New
Added async re-rendering for the wpdm_packages shortcode toolbar so filter / sort / paginate updates the results in place without a full page reload.
Added a per-file Size override field in the file-info metabox for granular control over displayed file sizes.
Changes
Public profile redesign and async [wpdm_packages] toolbar
Redesigned the wpdm_user_profile page with a modern cover/avatar layout, stat pills (packages, favourites, member since), and pill-style tabs that highlight in the user’s brand color.
Per-file download flow now respects the terms-and-conditions lock and correctly carries the file index through the unlock cycle.
Gated the wpdmpro custom-post-type capability and parent admin menu behind WPDM_MENU_ACCESS_CAP when set to manage_options .
Pre-fill the File Size input from Media Library attachments (uses filesizeHumanReadable ).
Escaped reset URLs on the download-history filter chips.
Switched the .__wpdm_submit_async submit handler to delegated binding so AJAX-injected forms keep working after replacement.
Proper output escaping on the public profile partials and dark-mode support (manual + prefers-color-scheme ).
May 7, 2026
7.3.8
1 fix2 changes
Fixed
Resolved an issue affecting the file list on the admin site.
Changes
File List Fix
May 3, 2026
7.3.7
1 fix5 changes
Fixed
Fixed WPDM\__\__::sanitize_var emitting a PHP warning — “Delimiter must not be alphanumeric or backslash” — when an unknown sanitize value (e.g. 'array' ) reached the regex fallback. Added an isRegexPattern guard so non-pattern values are returned unchanged
Changes
DropZone file-request page redesign and sanitize_var fix
Redesigned the DropZone file-request page as an enterprise-grade upload UI — two-column layout with a sticky sidebar (request meta + best-practices tips), a table-style file queue with per-row progress, sticky action bar with summary and Submit / Clear, dedicated success state, mobile responsive
Synced the DropZone main page with WPDM Color Scheme settings
Both DropZone views now pull the primary color from WPDM UI Settings
April 21, 2026
7.3.6
4 new2 fixes4 changes
New
Added dark mode support for User Dashboard (manual dark mode and system preference)
Added tag filter dropdown for [ wpdm_all_packages] shortcode ( tag_filter="true" )
Added Last Login column to WordPress admin Users list
Added DropZone admin page to WPDM admin styles whitelist
Fixed
Fixed DropZone comment form not resetting after submission
Fixed DropZone storage calculation crash when file path is missing
Changes
Dark mode for User Dashboard, tag filter for package tables, and DropZone fixes
Made category and tag names clickable in DataTables to filter by that term
Internationalized hardcoded “File Details” string in DropZone sidebar
April 16, 2026
7.3.5
1 fix2 changes
Fixed
Fix undefined index warning in login redirect on CLI/cron contexts
Changes
Guard $_SERVER["SERVER_NAME"] with isset check in login redirect validation to prevent undefined index warnings in CLI and cron contexts where server variables are not populated.
April 9, 2026
7.3.4
2 fixes1 security2 changes
Fixed
[ wpdm_category] shortcode toolbar — renamed the orderby / order select fields to orderby_ / order_ so they no longer collide with WordPress reserved query vars. Front-end sorting from the category toolbar now works reliably. (The same fix was applied to [ wpdm_packages] in 7.3.3; this release extends it to [ wpdm_category] and covers a couple of remaining spots in the packages toolbar that were missed.)
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ( Reported by Patchstack )
Security
Security
Changes
Category shortcode toolbar sort/order fix
April 2, 2026
7.3.3
5 improvements7 fixes1 security1 change
Improved
Video CDN detection now uses filterable array
Toolbar sort/order params renamed to avoid WordPress reserved query var conflicts
Added wpdm_all_packages_tags filter for DataTable row customization
File type icons now use SVG image files instead of inline SVGs
Admin modal and UI refinements
Fixed
Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode attributes (Reported by Wordfence)
Missing authorization check in Media Access Control
Email lock “Mail Download Link” checkbox not saving unchecked state
