CVE-2026-93654 is a stored cross-site scripting vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin (versions up to 7.2.1). The flaw arises from improper neutralization of input in the 'cart_items[][product_name]' parameter, enabling unauthenticated attackers to inject arbitrary scripts. The vulnerability is exacerbated by the checkout REST route's permission_callback set to __return_true, allowing unrestricted access, and the invoice loader's lack of order ownership verification, which permits the malicious payload to be rendered to any logged-in user viewing the invoice.

An unauthenticated attacker can inject persistent malicious scripts that execute in the context of any logged-in user who accesses the affected invoice page. This can lead to information disclosure and potential session hijacking or other client-side impacts. The vulnerability does not affect availability but compromises confidentiality and integrity to a limited extent.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the checkout REST route if possible and monitor for suspicious activity related to invoice access. Avoid using affected versions or consider disabling the plugin temporarily.