CVE-2026-18586

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.0.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the order email variable, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update Premium Packages – Sell Digital Products Securely to version 7.0.6 or later.