CVE-2026-110664: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in codename065 Premium Packages – Sell Digital Products Securely

CVE-2026-110664 describes a stored cross-site scripting vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin. The flaw exists in all versions up to 7.2.8 and involves the 'note' parameter, which does not properly sanitize or escape input. Attackers with subscriber-level privileges or higher can inject hex-escaped payloads that bypass tag-based filters because the sanitization function sanitize_textarea_field does not remove these sequences. The payload is then decoded by stripcslashes() during admin page rendering, resulting in execution of arbitrary scripts in users' browsers.

Successful exploitation allows authenticated attackers with subscriber-level access or higher to inject and execute arbitrary web scripts in the context of affected pages. This can lead to partial compromise of confidentiality and integrity (CVSS impact: Confidentiality Low, Integrity Low, Availability None). The vulnerability could be used to perform actions such as session hijacking or defacement within the scope of the affected site.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level user permissions where possible and avoid using the vulnerable 'note' parameter for untrusted input. Implement additional input validation or sanitization at the application or web server level if feasible.