Unauthenticated Stored XSS in Premium Packages WordPress Plugin

The 'Premium Packages - Sell Digital Products Securely' plugin for WordPress, in all versions up to and including 7.0.5, contains a critical security vulnerability identified as CVE-2026-18586. This flaw is an unauthenticated stored cross-site scripting (XSS) vulnerability located within the 'order_email' parameter. The issue arises from the plugin's failure to properly sanitize user-supplied input or escape output rendered in the WordPress administrative or front-end interface. Because the vulnerability is unauthenticated, any remote attacker can submit malicious JavaScript payloads through the plugin's checkout or order flow. Once stored, these scripts execute within the browser session of any user - including high-privileged administrators - who subsequently views the affected order information pages. This represents a significant risk for session hijacking, administrative account takeover, or the redirection of users to malicious third-party content.

Impact

Successful exploitation of CVE-2026-18586 allows unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's session. This can lead to the unauthorized modification of site content, exfiltration of sensitive information, or complete takeover of administrative accounts if an administrator views the injected order details. The vulnerability affects all sites running versions 7.0.5 or earlier of the 'Premium Packages' plugin.

Recommendation

Prioritize updating the WordPress plugin to the latest version, ensuring all installations are beyond version 7.0.5. As this is an input sanitization flaw, organizations should identify instances of this plugin using asset inventory logs and verify patch application. Given the potential for session hijacking, monitor for unusual administrative activities or unauthorized changes to user accounts following the discovery of suspicious payloads.