Coopernicus

**Name of the Vulnerable Software and Affected Versions** Premium Packages – Sell Digital Products Securely versions prior to 7.2.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue exists in the `cart items[][product name]` parameter. The checkout REST route uses a `permission callback` set to ` return true`, and the invoice loader lacks order ownership checks, enabling attackers to persist payloads that execute when any logged-in user accesses the invoice. **Recommendations** Update Premium Packages – Sell Digital Products Securely to version 7.2.2 or later.