{"vulnerability": "CVE-2026-103478", "sightings": [{"uuid": "fb42b799-f974-416d-abba-0d55b114902b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103478", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415541957018837", "content": "CVE-2026-103478 Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter The Premium Packages \u2013 Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid / email)' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103478https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=cvehttps://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L125https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L108https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L115https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/templates/dashboard/billing-info.php#L132https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L265https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L424https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.6/src/Customer/BillingInfoService.php#L190https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/https://plugins.trac.wordpress.org/changeset/3724154/wpdm-premium-packages/trunk/templates/dashboard/billing-info.php#wordpress #codename065 #PremiumPackages\u2013SellDigitalProductsSecurely#CVE_2026_103478#bot", "creation_timestamp": "2026-10-10T07:56:27.993730Z"}]}