The Premium Packages – Sell Digital Products Securely plugin contains a stored cross‑site scripting flaw that can be triggered when an authenticated user adds an order note containing a specially encoded payload. The plugin sanitizes input with a function that leaves hexadecimal‑escaped sequences intact and only decodes them later when rendering the page for administrators. This allows an attacker to store a malicious script that will execute on the next visit of any user who can view the note, enabling session hijacking or defacement.

WordPress sites running the Premium Packages plugin version 7.2.8 or earlier are affected. All releases up to and including 7.2.8 lack the proper sanitization required to prevent the XSS payload from being stored and later executed.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. However, exploitation requires only authenticated access with subscriber‑level permissions, which is commonly granted to regular users. The attacker exploits the flaw by adding an order note with hex‑escaped malicious content; the note is stored, later decoded, and rendered as executable code in the browser. Because the payload runs in the context of any user who views the note, it can lead to credential theft, session hijacking, or site defacement. Given the breadth of sites using this plugin, the potential impact is considerable, especially when combined with other web application weaknesses.