CVE-2026-18586: Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication, user interaction, or elevated privileges to submit a malicious value through the affected order_email field. Exploitation is network-accessible and has low attack complexity.
When does the injected script run?
The script is stored and executes when a user accesses a page containing the injected content. The vulnerability affects confidentiality and integrity, but the supplied metrics indicate no direct availability impact.
Which plugin versions are affected?
All versions of Premium Packages – Sell Digital Products Securely through 7.0.5, including version 7.0.5, are affected.