CVE-2026-18586
7.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated remote attackers can execute malicious JavaScript in the browsers of users—including administrators—viewing order pages. They only need network access to submit a crafted 'order_email' value.
Root cause
The plugin fails to sanitize and escape the 'order_email' parameter before rendering it in order views.
Affected systems
Premium Packages – Sell Digital Products Securely plugin for WordPress up to, and including, 7.0.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade the plugin to a version later than 7.0.5. If patching cannot be done immediately, deactivate the plugin until updated.
$ wp plugin update wpdm-premium-packagesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.