CVE-2026-110664 in Premium Packages Plugin
Summary
by MITRE • 10/16/2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses tag-based filtering because the payload is stored as a hex-escaped sequence (e.g., \x3cimg onerror=...\x3e) that sanitize_textarea_field does not strip, and is only decoded back into a live HTML tag by stripcslashes() during admin rendering — after all sanitization has occurred.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Premium Packages – Sell Digital Products Securely plugin for WordPress contains a critical security vulnerability affecting versions up to 7.2.8 that allows authenticated attackers with subscriber-level access or higher to execute stored cross-site scripting attacks. This flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically targeting the 'note' parameter used in product descriptions or administrative notes. The severity of this vulnerability is compounded by its persistence; unlike reflected XSS where malicious scripts are executed only during a specific request, stored vulnerabilities reside on the server side, ensuring that every user who views the affected page will trigger the execution of the injected script. This creates a persistent threat vector capable of compromising not just individual users but potentially entire sites if administrative accounts or high-privilege roles interact with the tainted data.
The technical root cause lies in the specific handling of input data through PHP functions that fail to adequately neutralize malicious payloads before they are rendered in an HTML context. The plugin utilizes the WordPress function sanitize_textarea_field for initial sanitization, which is designed to strip tags and encode special characters. However, attackers successfully bypass this filter by encoding their payload using hex-escaped sequences, such as \x3cimg onerror=...\x3e. Because sanitize_textarea_field does not interpret or remove these hexadecimal representations of HTML entities, the malicious string passes through the initial validation layer intact. The vulnerability is fully realized during the rendering phase in the admin interface, where the function stripcslashes() is applied to decode escape sequences back into their literal character forms. This decoding occurs after sanitization has already taken place, effectively re-introducing dangerous HTML tags like img or script that were previously neutralized by other filters but remain active due to this specific encoding bypass technique.
From an operational perspective, the impact of this vulnerability is significant for any WordPress site utilizing this plugin with users possessing subscriber-level access or above. An attacker can inject scripts that steal session cookies, hijack user sessions, perform actions on behalf of authenticated users, or redirect victims to phishing sites. Since the payload is stored in the database, it affects all subsequent page loads until the malicious content is manually removed from the database by an administrator. This persistence makes remediation difficult if access controls are not strictly enforced, as even low-privilege users can poison data that higher-privileged administrators will inevitably view and execute against their own browsers. The ability to bypass tag-based filtering demonstrates a sophisticated understanding of WordPress sanitization workflows, indicating that this is not merely an oversight but a structural flaw in how the plugin processes user-supplied input before final output generation.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. Furthermore, it maps to MITRE ATT&CK technique T1059.007, specifically JavaScript execution in a browser environment via stored payloads. The exploitation path involves initial access through valid credentials (T1078), followed by persistence or impact depending on the attacker's goals, often leveraging social engineering if the payload is designed to trick users into clicking links or interacting with injected elements. To mitigate this risk, site administrators should immediately update the Premium Packages plugin to a version where this specific hex-escaping bypass has been patched and output escaping is enforced consistently across all rendering contexts regardless of input sanitization methods. Until an official patch is available, restricting user roles that can submit data containing special characters or implementing strict Content Security Policy headers may help reduce the impact of any successful exploitation attempts by limiting script execution capabilities in victim browsers.