CVE-2026-103478

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.7

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the checkout[billing][phone], state, taxid, and email parameters, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update the plugin to version 7.2.7 or later.