EUVD-2026-86594
GHSA-x4g8-6q4g-hgjf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated open REST route gives PR:N/AV:N/AC:L; cross-context script execution in a victim's session yields S:C with C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin (versions up to and including 7.2.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the cart_items[][product_name] parameter, which is persisted and later executed in the browser of any logged-in user who views an affected invoice page. The plugin's checkout REST route is exposed without authentication (permission_callback set to __return_true) and its invoice loader performs no order ownership check, confirming remote unauthenticated exploitation against default configurations with no special conditions; impact is confined to client-side script execution in the viewer's session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions to plant the payload - remote unauthenticated exploitation against default configurations of the Premium Packages plugin (<=7.2.1) is possible because the checkout REST route sets permission_callback to __return_true and the invoice loader enforces no order ownership check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) is credible and internally consistent with the description: the checkout REST route uses permission_callback set to __return_true (PR:N confirmed) and the invoice loader performs no ownership check, so a network attacker can persist the payload without authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The plugin's Trac changeset 3708519 provides an upstream fix; because it is a commit-level change rather than a tagged release, a released patched version has not been independently confirmed, so patch status is 'upstream fix available (PR/commit); released patched version not independently confirmed'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress installation running Premium Packages - Sell Digital Products Securely at version 7.2.1 or below, confirm which instances are active on internet-facing sites, and deactivate and remove the plugin wherever it is not essential to revenue operations; where it must remain live, front the site with a WAF configured to block script payloads in the cart_items[][product_name] parameter and restrict reachability of the checkout REST route and invoice pages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today