CVE-2026-103478: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in codename065 Premium Packages – Sell Digital Products Securely

CVE-2026-103478 is a stored cross-site scripting vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin by codename065. The issue arises from improper input sanitization and output escaping of the 'checkout[billing][phone]', 'state', 'taxid', and 'email' parameters. Authenticated attackers with subscriber-level privileges or higher can inject arbitrary JavaScript code that executes in the context of other users viewing the injected pages. This vulnerability affects all versions from 0 up to and including 7.2.6.

An attacker with subscriber-level access or higher can exploit this vulnerability to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to partial confidentiality and integrity loss, such as session hijacking or unauthorized actions performed on behalf of users. Availability is not impacted. There are no known exploits in the wild at this time.

No official patch or fix has been confirmed or provided by the vendor as of the published date. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict subscriber-level user privileges where possible and consider additional input validation or web application firewall rules to mitigate injection attempts.