{"id":"CVE-2026-103478","aliases":["EUVD-2026-96290","GHSA-w63c-v3r4-fwv7"],"status":"published","title":"Premium Packages \u003c= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00298,"percentile":0.22742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-10T07:41:48Z","modified":"2026-10-13T13:30:21Z","products":[{"vendor":"codename065","product":"premium packages – sell digital products securely"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L125"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L108"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L115"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L132"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L265"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L424"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L190"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/"},{"url":"https://plugins.trac.wordpress.org/changeset/3724154/wpdm-premium-packages/trunk/templates/dashboard/billing-info.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103478"},{"url":"https://plugins.trac.wordpress.org/browser/wpdm-premium-packages"},{"url":"https://github.com/advisories/GHSA-w63c-v3r4-fwv7"}],"sources":{"cve":[{"id":"CVE-2026-103478","title":"Premium Packages \u003c= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-10T07:41:48.934Z","modified":"2026-10-11T12:13:43.531Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-96290","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-10T07:41:48Z","modified":"2026-10-11T12:13:43Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:22.526044Z"}],"ghsa":[{"id":"GHSA-w63c-v3r4-fwv7","title":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to...","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-10T09:30:28Z","modified":"2026-10-10T09:30:36Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:13:01.926366Z"}],"nvd":[{"id":"CVE-2026-103478","description":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-10T08:17:03.793Z","modified":"2026-10-13T13:30:21.62Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:55.473789Z"}]}}