CVE-2026-18586: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in codename065 Premium Packages – Sell Digital Products Securely

CVE-2026-18586 is a stored cross-site scripting vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin by codename065. The flaw arises from improper neutralization of input in the 'order_email' field, allowing unauthenticated attackers to inject malicious scripts that execute in the context of users viewing the injected pages. This affects all versions up to and including 7.0.5. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users accessing the injected pages, potentially leading to information disclosure and integrity loss. There is no impact on availability. The vulnerability affects confidentiality and integrity with a scope change, meaning the attacker can affect resources beyond their initial privileges.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, consider restricting access to affected pages or implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'order_email' parameter.