Stored Cross-Site Scripting Vulnerability in Premium Packages by WordPress

CVE-2026-110664

What is CVE-2026-110664?

The Premium Packages – Sell Digital Products Securely plugin for WordPress contains a vulnerability that allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the 'note' parameter. This occurs due to insufficient input sanitization and output escaping methods in versions up to and including 7.2.8. The vulnerability exploits the fact that certain payloads are stored as hex-escaped sequences, evading tag-based filtering, allowing scripts to execute when a user accesses an affected page. The lack of proper sanitization means that malicious scripts can be unintentionally rendered and executed within administrative contexts, compromising the security of the application and its users.

References