Published October 15, 2026: Wordfence disclosed CVE-2026-18586, an unauthenticated stored cross-site scripting (XSS) flaw in the “Premium Packages – Sell Digital Products Securely” plugin, affecting versions through 7.0.5 (CVSS 7.2, High). Weak sanitization of the order email field lets an attacker store malicious JavaScript that executes whenever the order record is viewed in a browser — a direct threat to admin sessions on digital-commerce sites. No active exploitation has been confirmed so far.
If you sell digital products with this plugin, patch immediately and review recent orders for suspicious entries. Stored XSS flaws like this are frequently used for session theft and silent backdoors, so treating it as urgent — even without a confirmed campaign — is the right call.
Our website care plans include plugin patching, security monitoring, and incident response, so flaws like this get handled before they become incidents. Learn more at https://qamardigitalventuresllc.com/
Source: Wordfence via CyberSuite (October 2026).
