Description

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:41.437Z",
  "pubdate": "2026-09-25T08:16:41.437Z",
  "executiveSummary": "The Premium Packages – Sell Digital Products Securely plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 7.2.1.\nThe flaw originates from the failure to adequately sanitize the 'cart_items[][product_name]' parameter during the checkout process.\nBecause the plugin's checkout REST route utilizes a '__return_true' permission_callback and lacks appropriate invoice ownership validation, unauthenticated attackers can successfully inject malicious JavaScript payloads.\nThese payloads are persisted within the application and execute in the browser context of any user who views the affected invoice, including administrators.\nThis vulnerability poses a significant security risk, as it allows unauthenticated remote actors to perform unauthorized actions, steal session cookies, or redirect users, effectively compromising the integrity and security of the affected WordPress site.",
  "technicalDetails": "The vulnerability is a Stored XSS flaw stemming from insufficient input sanitization and output escaping within the Premium Packages – Sell Digital Products Securely plugin. The specific vector is the 'cart_items[][product_name]' parameter utilized during the plugin's checkout REST API endpoint.\nThe root cause of this vulnerability involves two primary security failures. First, the REST API endpoint responsible for processing cart items fails to sanitize the 'product_name' input. Consequently, an attacker can submit a crafted HTTP request containing arbitrary script tags or malicious event handlers within this parameter. Second, the plugin displays this unsanitized data on invoice pages without implementing proper output escaping, leading to the execution of the injected script in the context of the victim's session.\nThe exploitation process is facilitated by a lack of access controls in the plugin's architecture. The REST route's 'permission_callback' is configured to '__return_true', which explicitly permits unauthenticated users to interact with the checkout functionality. Furthermore, the invoice loader lacks an authorization check to verify ownership of the requested order. This allows an attacker to inject a payload into an order and then force the system to render that payload when an unsuspecting user, such as an administrator, accesses the invoice page.\nAn attack flow follows these steps: 1) The unauthenticated attacker identifies the vulnerable REST route and crafts a POST request containing a malicious payload injected into the 'cart_items[][product_name]' parameter. 2) The plugin accepts the malicious input and stores it within the database as part of the order data. 3) The attacker triggers the invoice loading mechanism or waits for a user to access the specific invoice. 4) When the victim navigates to the invoice URL, the server retrieves the persisted malicious payload from the database and renders it directly into the HTML response. 5) The victim's browser executes the script, leading to unauthorized actions such as cross-site request forgery, session hijacking, or credential theft.\nThe vulnerability affects all plugin versions up to and including 7.2.1. Given the design flaws in the permission handling and input validation, any site utilizing this plugin is exposed to remote exploitation by unauthenticated actors over the network."
}