CVE-2026-93654highCWE-79

CVE-2026-93654: high-severity vulnerability in codename065 Premium Packages – Sell Digital…

Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

Published

Follow this CVE+ Monitor Premium Packages – Sell Digital Products Securely

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.2%
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
codename065 · Premium Packages – Sell Digital Products Securely
Related CVEs — codename065 Premium Packages – Sell Digital…

In the same product, most dangerous first.

CVE-2026-12800HIGHPremium Packages <= 6.2.0 - Unauthenticated SQL InjectionEPSS 1.6%CVE-2023-4293HIGHPremium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege EscalationEPSS 1.0%CVE-2026-15348MEDIUMPremium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' ParameterEPSS 0.6%CVE-2024-11225MEDIUMPremium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_argEPSS 0.6%CVE-2024-10164MEDIUMPremium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link ShortcodeEPSS 0.5%CVE-2026-15906MEDIUMPremium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' ParameterEPSS 0.5%