CVE-2026-93654

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue exists in the cart items[][product name] parameter. The checkout REST route uses a permission callback set to return true, and the invoice loader lacks order ownership checks, enabling attackers to persist payloads that execute when any logged-in user accesses the invoice.

Recommendations Update Premium Packages – Sell Digital Products Securely to version 7.2.2 or later.