Premium Packages CVE-2026-103478

Exploitation requires an authenticated account with subscriber-level privileges or above (PR:L), meaning the attacker must be able to register or obtain a low-privilege account on the target WordPress site - realistic for this plugin because selling digital products typically entails open customer registration. The specific injection points are the checkout billing fields 'checkout[billing][phone]', 'state', 'taxid', and 'email', which are stored without sufficient sanitization and rendered without output escaping in the dashboard billing-info page (templates/dashboard/billing-info.php). As stored XSS, no victim interaction is needed at injection time, but payload execution is gated on a user - typically a site administrator or staff member - subsequently viewing the attacker-controlled billing data. Limiting factors: the plugin must be installed (versions ≤7.2.6), low-privilege registration must be permitted, and impact is confined to script execution in the viewing user's browser session rather than direct server compromise.

This is a moderate-risk stored XSS (CVSS 6.4 Medium, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that should be treated as a routine patch rather than an emergency. The CVSS vector shows network reachability with low complexity, but critically requires PR:L - authenticated subscriber-level access - which meaningfully constrains the attacker pool to users who can register on the target site. No EPSS score, KEV listing, or public POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation. The scope change (S:C) and Low confidentiality/integrity impacts reflect that injected script executes in a victim's browser context (e.g., an administrator viewing the billing data) rather than directly compromising the server. EPSS is missing, so widespread-exploitation probability cannot be quantified; given this is a niche commercial WordPress plugin reported through Wordfence's research program (not opportunistic disclosure), real-world priority is low-to-moderate. The main caveat: exploitation depends on open user registration being enabled, which is common for a plugin whose purpose is selling digital products to registered customers.

An attacker registers a subscriber-level account on a site running the Premium Packages plugin (v7.2.6 or earlier), then submits a crafted billing phone/state/taxid/email value containing a JavaScript payload through the checkout/billing-info form. The unsanitized value is stored and later rendered in the dashboard billing-info page, so when a site administrator or staff member views that customer's billing details the script executes in their authenticated browser session. No public exploit code was identified at time of analysis, but the injection path is straightforward for an authenticated user.