Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Billing State, Phone and Tax ID Fields
- ID
- WPSEC-2026-0369
- Plugin
- Premium Packages – Sell Digital Products Securely (wpdm-premium-packages)
- Affected
- all versions before 7.2.7
- Remediation
- Update to 7.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Premium Packages on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-103478, on 2026-10-09.
Description
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the billing State / Province, Phone and Tax ID fields in all versions up to, and including, 7.2.6. This is due to insufficient output escaping: the values a user saves to their own billing profile (front-end Edit Profile dashboard, the wp-admin profile page, or checkout) are only text-sanitized, which keeps double quotes, and are echoed unescaped into input value attributes of the billing form that is also rendered on the user's profile screen in wp-admin. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts that execute when an administrator views the attacker's user profile.
References
- https://wpsec.com/vuln/WPSEC-2026-0369/
- https://plugins.svn.wordpress.org/wpdm-premium-packages/tags/7.2.7/
- https://wordpress.org/plugins/wpdm-premium-packages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS