Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2026-18586: Premium Packages plugin lets attackers run scripts on site
CVE-2026-18586 · published 21 days ago
Summary
The Premium Packages – Sell Digital Products Securely plugin for WordPress, up to version 7.0.5, does not properly clean user input, allowing anyone to insert harmful code that runs whenever a page is viewed. This can let attackers steal information or manipulate the site. Update the plugin to the latest version or apply the vendor's patch to protect your site.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| codename065 | premium packages – sell digital products securely | <= 7.0.5 |
Original advisory text
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Oct 2026
Updated4 Nov 2026
First seen15 Oct 2026
Track software like this
Free during beta