{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/premium-packages--sell-digital-products-securely--7.0.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:premium_packages:premium_packages:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-18586"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Premium Packages – Sell Digital Products Securely (\u003c= 7.0.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress","cve-2026-18586"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe 'Premium Packages - Sell Digital Products Securely' plugin for WordPress, in all versions up to and including 7.0.5, contains a critical security vulnerability identified as CVE-2026-18586. This flaw is an unauthenticated stored cross-site scripting (XSS) vulnerability located within the 'order_email' parameter. The issue arises from the plugin's failure to properly sanitize user-supplied input or escape output rendered in the WordPress administrative or front-end interface. Because the vulnerability is unauthenticated, any remote attacker can submit malicious JavaScript payloads through the plugin's checkout or order flow. Once stored, these scripts execute within the browser session of any user - including high-privileged administrators - who subsequently views the affected order information pages. This represents a significant risk for session hijacking, administrative account takeover, or the redirection of users to malicious third-party content.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-18586 allows unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's session. This can lead to the unauthorized modification of site content, exfiltration of sensitive information, or complete takeover of administrative accounts if an administrator views the injected order details. The vulnerability affects all sites running versions 7.0.5 or earlier of the 'Premium Packages' plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize updating the WordPress plugin to the latest version, ensuring all installations are beyond version 7.0.5. As this is an input sanitization flaw, organizations should identify instances of this plugin using asset inventory logs and verify patch application. Given the potential for session hijacking, monitor for unusual administrative activities or unauthorized changes to user accounts following the discovery of suspicious payloads.\u003c/p\u003e\n","date_modified":"2026-10-15T06:35:49Z","date_published":"2026-10-15T06:35:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-18586/","summary":"The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.","title":"Unauthenticated Stored XSS in Premium Packages WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-18586/"}],"language":"en","title":"CraftedSignal Threat Feed - Premium Packages – Sell Digital Products Securely (\u003c= 7.0.5)","version":"https://jsonfeed.org/version/1.1"}