This vulnerability enables an unauthenticated attacker to inject arbitrary JavaScript into the "order_email" field of the Premium Packages – Sell Digital Products Securely plugin. The injected script is stored and will execute in the browser whenever a user views a page that displays the affected order, potentially allowing the attacker to steal session cookies, deface the site, or perform phishing attacks. The weakness is a classic input sanitization flaw that fails to escape or validate user‑supplied content, allowing malicious code to persistently reside within the database.

Any WordPress installation that has installed the Premium Packages plugin in a version up to and including 7.0.5 is affected. Site administrators using this plugin to sell digital products must verify their installed version and consider the plugin a critical component of the site’s attack surface.

With a CVSS score of 7.2 the vulnerability is classified as high severity. Exploitation does not require authentication, meaning any internet‑visible user can submit a crafted "order_email" entry. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV database, but the lack of authentication barrier and the potential for widespread impact elevate the risk for exposed WordPress sites that have not upgraded the plugin.