Premium Packages CVE-2026-18586

Injection requires only the ability to submit the 'order_email' value as an unauthenticated user, so it works against default configurations of the Premium Packages - Sell Digital Products Securely plugin (versions ≤ 7.0.5) wherever order submission is exposed. The key LIMITING factor is that the stored payload does not fire at injection time: execution is deferred until a privileged user - per the referenced list-orders.php admin view, a store administrator - loads the order-list page, so the attack depends on that victim action and on the plugin being active and below the patched version.

CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating a network-reachable, low-complexity, unauthenticated stored XSS whose scope change (S:C) reflects script executing in a different security context (the WordPress admin viewing the orders list) than where it was injected. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so exploitation status is: no public exploit identified at time of analysis - there is no signal of active or widespread exploitation. The realistic risk is moderate rather than critical: the AV:N/PR:N/UI:N metrics make injection trivially accessible to anyone who can submit an order, but actual script execution depends on a privileged user (store operator/admin) subsequently opening the affected order-list page, and the confidentiality/integrity impact is only Low (C:L/I:L) with no availability impact. This profile is typical of unauthenticated stored XSS in WordPress plugins - genuinely worth patching because the injection barrier is zero, but not a mass-exploitation emergency absent any EPSS/KEV/POC evidence. Note a scoring tension: the provided vector uses UI:N, yet stored XSS that only fires when an admin manually browses to the orders page arguably warrants UI:R; verify against Wordfence's advisory.

An unauthenticated attacker places or submits an order on a site running the Premium Packages plugin and injects a malicious script payload into the 'order_email' field, which is stored without sanitization. When a store administrator later opens the WordPress admin order-list page to review orders, the stored script executes in their authenticated browser session, enabling actions such as session/cookie theft or performing admin operations on the attacker's behalf. No public exploit code was identified in the provided data.