CVE-2026-103478

Deferred Deferred - Pending Action

Stored XSS in Premium Packages – Sell Digital Products Securely WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Wordfence

Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103478

EUVD

EUVD-2026-96290

Affected Vendors & Products

Vendor	Product	Version / Range
codename065	Premium	Packages – Sell Digital Products Securely 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to inject malicious scripts via unsanitized input fields like phone, state, tax ID, or email during checkout. These scripts execute when other users view the compromised pages.

Detection Guidance

This vulnerability can be detected by checking for the presence of the Premium Packages – Sell Digital Products Securely plugin version 7.2.6 or lower. Inspect WordPress installations for the plugin and verify its version. Look for suspicious scripts in pages where user input fields like billing phone, state, taxid, or email are rendered.

Impact Analysis

If you use this plugin, attackers could steal session cookies, redirect you to malicious sites, or perform actions on your behalf. Users with subscriber access or above could compromise your site and its visitors. The vulnerability requires authentication but can affect all users interacting with infected pages.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information if exploited. Both standards mandate protecting user data, and this flaw could result in non-compliance if exploited.

Mitigation Strategies

Immediately update the Premium Packages – Sell Digital Products Securely plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin. Review user roles to ensure only trusted users have subscriber-level access or higher. Monitor for unauthorized script injections in web pages.

Hi! I’m here to help you understand CVE-2026-103478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70