Stored XSS in Premium Packages WordPress Plugin via REST API

The Premium Packages - Sell Digital Products Securely plugin for WordPress (versions 7.2.1 and earlier) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability stems from insufficient input sanitization and output escaping within the 'cart_items[][product_name]' parameter. An unauthenticated attacker can leverage the plugin's checkout REST API route, which incorrectly sets a permission_callback to __return_true, to inject arbitrary JavaScript payloads. Furthermore, the invoice loader fails to implement order ownership checks, allowing the attacker to ensure the malicious payload is rendered when an authorized user accesses the invoice page. This flaw allows for unauthorized client-side code execution in the victim's browser, potentially leading to session hijacking, credential theft, or administrative action performance.

Attack Chain

1. Attacker identifies a WordPress site utilizing the Premium Packages plugin version 7.2.1 or lower.
2. Attacker crafts a malicious payload containing JavaScript within the 'cart_items[][product_name]' parameter.
3. Attacker sends an unauthenticated POST request to the plugin's checkout REST API endpoint.
4. The plugin accepts the malicious input due to the weak permission_callback configuration.
5. The server stores the malicious product name in the invoice database.
6. An administrative or authorized user navigates to the invoice page containing the injected payload.
7. The server renders the invoice, and the victim's browser executes the stored JavaScript.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of legitimate site users, including administrators. This can lead to full site compromise, unauthorized administrative actions, or the theft of session tokens and sensitive user information.

Recommendation

1. Update the Premium Packages - Sell Digital Products Securely plugin to the latest version, ensuring it exceeds 7.2.1, to remediate CVE-2026-93654.
2. Review web server logs for suspicious POST requests directed at plugin-specific REST API endpoints containing script tags or common XSS patterns in the request body.
3. Implement strict Content Security Policy (CSP) headers to mitigate the impact of stored