CVE-2026-103478: Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required from the attacker to store the malicious payload.
Which inputs are implicated?
The affected checkout billing fields include phone, state, tax ID, and email. Malicious script supplied through these parameters can be stored and later execute when someone accesses the injected page.
Who is at risk from a stored payload?
Any user who accesses a page containing the injected content may trigger the script in their browser. Because the vulnerability has scope changed, the impact can extend beyond the low-privileged account used to submit the payload.
Which versions are affected?
All versions of the plugin through 7.2.6, including 7.2.6, are affected. The provided information does not identify a fixed version.