CVE-2026-103478 in Premium Packages Plugin
Summary
by MITRE • 10/10/2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 7.2.6. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which represents one of the most prevalent web application vulnerabilities identified by industry standards such as CWE-80. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's codebase. Specifically, user-supplied data submitted through the checkout process is not adequately validated or encoded before being stored in the database and subsequently rendered to other users without proper context-aware encoding.
The vulnerability targets specific parameters associated with customer billing information during a purchase transaction. Attackers can exploit this flaw by injecting malicious JavaScript payloads into fields such as checkout[billing][phone], state, taxid, and email. Because these values are stored in the database after submission, they become persistent across sessions. This persistence distinguishes Stored XSS from Reflected XSS, where the payload is only executed during a single request. In this scenario, the malicious script remains embedded within the application's data layer until it is retrieved and displayed to legitimate users viewing order details or customer information pages managed by administrators or other authenticated subscribers with elevated privileges.
The operational impact of this vulnerability is significant due to the requirement for authentication. While an attacker must possess subscriber-level access or higher, such credentials are relatively easy to obtain through credential stuffing attacks, phishing campaigns, or brute force attempts against WordPress login endpoints. Once authenticated, a low-privilege user can inject scripts that execute in the context of any other user who views the affected page. This execution occurs within the victim's browser session, granting the attacker the ability to perform actions on behalf of the victim. Potential consequences include session hijacking through cookie theft, redirection to malicious phishing sites designed to capture further credentials, defacement of the website interface, or the installation of keyloggers that record sensitive data entered by administrators and other users.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection (T1059) and potentially Account Manipulation if used for persistent access persistence via stored scripts in user profiles or order histories. The attack vector is primarily web-based and requires low complexity due to the straightforward nature of form submission exploitation. It falls under CWE-79, which covers Improper Neutralization of Input During Web Page Generation, highlighting the failure to apply appropriate encoding based on the output context.
Mitigation strategies should focus on immediate remediation through software updates. Administrators running affected versions must upgrade the Premium Packages plugin to version 7.2.7 or later, where developers have implemented proper input validation and output escaping functions consistent with WordPress coding standards. Until an update is applied, temporary mitigations include restricting access to administrative areas using strong multi-factor authentication to reduce the risk of credential compromise that could lead to exploitation. Additionally, implementing a Web Application Firewall (WAF) can help detect and block common XSS payloads in POST requests targeting checkout endpoints. Regular security audits and code reviews focusing on data handling practices are essential to prevent similar vulnerabilities from being introduced into WordPress ecosystems in the future.