CVE-2026-93654 codename065 CVE debrief

Who should care

Defenders responsible for WordPress installations using the Premium Packages – Sell Digital Products Securely plugin, especially those with publicly accessible checkout and invoice functionality, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-93654 is a high-severity vulnerability in the Premium Packages – Sell Digital Products Securely plugin for WordPress, allowing unauthenticated attackers to inject malicious scripts in the checkout and invoice pages. Defenders should prioritize verifying the presence of this vulnerability, assessing exposure, and remediating it to prevent potential attacks.

• Unauthenticated attackers can inject and persist malicious scripts in the checkout and invoice pages.
• Successful exploitation allows attackers to execute arbitrary scripts in the context of logged-in users accessing the affected pages.
• Defenders need to verify the presence of this vulnerability in their WordPress installations and assess exposure of the checkout and invoice functionality.
• Remediation priority is high due to the potential for attackers to exploit this vulnerability without authentication.

Technical summary

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cart_items[][product_name]' parameter in all versions up to, and including, 7.2.1. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of the checkout and invoice functionality.

Recommended defensive actions

• Verify the presence of the Premium Packages – Sell Digital Products Securely plugin in your WordPress installation and check if the version is 7.2.1 or earlier.
• Assess exposure of the checkout and invoice functionality to unauthenticated attackers.
• Consider restricting access to the checkout and invoice pages to authenticated users only.
• Update the plugin to a version that fixes the vulnerability, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and the affected plugin version. The vulnerability is caused by insufficient input sanitization and output escaping in the 'cart_items[][product_name]' parameter. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, allowing an unauthenticated attacker to both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice. Evidence,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.