The Premium Packages – Sell Digital Products Securely plugin stores cart items without proper sanitization or escaping of the 'cart_items[][product_name]' field, allowing an attacker to persist arbitrary JavaScript code that renders in the generated invoice page. Because the checkout REST route uses permission_callback set to __return_true and the invoice loader performs no ownership checks, an injected script can execute whenever any logged‑in user opens an invoice, enabling defacement, credential theft, or other malicious actions.

Any WordPress installation running the Premium Packages plugin from version 7.2.1 or earlier is vulnerable. The vendor, codename065, publishes the plugin under the name Premium Packages – Sell Digital Products Securely. The vulnerability exists in every release up to and including 7.2.1, affecting all environments that use this plugin to handle digital product sales.

The CVSS base score of 7.2 indicates high severity, while the EPSS score is unavailable and the flaw is not listed in CISA KEV. The lack of authentication required for injection and the persistence of the payload make exploitation straightforward. An attacker can simply add a malicious product to a cart, trigger the invoice generation, and cause the script to run for any user who views the invoice. Because no ownership verification is performed, compromised content can be accessed by other users, broadening the potential impact.