The Premium Packages plugin for WordPress is vulnerable to stored cross‑site scripting because the checkout [billing][phone] field, along with state, taxid, and email, is written to the database without sanitization or proper output escaping. An authenticated user with subscriber‑level or higher role can submit malicious script payloads that are stored and later executed whenever any user visits a page that renders the stored data. This allows attackers to deface the site, steal session cookies, display phishing dialogs, or inject arbitrary JavaScript to compromise user accounts.

WordPress sites running the Premium Packages – Sell Digital Products Securely plugin version 7.2.6 or earlier are affected. The vulnerability is present in all releases up to and including 7.2.6, regardless of the WordPress core version, provided the plugin is active and users can edit billing information. Sites that use the plugin to process digital product purchases and have subscriber‑level access to the checkout form are therefore impacted.

The CVSS score of 6.4 indicates moderate overall risk, and the EPSS score is currently unavailable while the vulnerability is not listed in the CISA KeV catalog. The likely attack vector is an authenticated web request from a subscriber or higher role to the billing form. Exploitation is straightforward once the user provides a payload; no additional privilege escalation is required. The stored XSS could compromise the confidentiality, integrity, or availability of any user that views the injected page, making it a potentially high‑impact risk if left unpatched.