CVE-2026-18586: high-severity vulnerability in codename065 Premium Packages – Sell Digital…
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.2%
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
codename065 · Premium Packages – Sell Digital Products SecurelyRelated CVEs — codename065 Premium Packages – Sell Digital…
In the same product, most dangerous first.
CVE-2026-12800HIGHPremium Packages <= 6.2.0 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2023-4293HIGHPremium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 1.0%CVE-2026-15348MEDIUMPremium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' ParameterEPSS 0.6%CVE-2024-11225MEDIUMPremium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_argEPSS 0.6%CVE-2024-10164MEDIUMPremium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link ShortcodeEPSS 0.5%CVE-2026-15906MEDIUMPremium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' ParameterEPSS 0.5%