---
id: "CVE-2026-110664"
kind: "vulnerability"
aliases: ["CVE-2026-110664"]
title: "WordPress Premium Packages plugin: stored XSS via note parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-untrusted-subscribers", "patched-version", "plugin-not-installed"]
published_at: "2026-10-16T07:17:11+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:59:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110664", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Premium Packages plugin: stored XSS via note parameter

The Premium Packages WordPress plugin up to and including 7.2.8 stores attacker-supplied text in the 'note' field without proper sanitization or escaping, so hex-escaped HTML is decoded into live markup when rendered. An authenticated subscriber can inject scripts that run in the browser of any user who opens the affected page, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get premium-packages --field=version` (slug assumed; confirm it).
- Look for stored 'note' values containing `\x3c` sequences in the plugin's database tables.

## Fix

- Update the Premium Packages plugin to a version later than `7.2.8`; the sources do not name the fixed version, so unknown.
- Until patched, restrict or remove subscriber accounts that can submit the 'note' field.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110664

## From the sources

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses tag-based filtering because the payload is stored as a hex-escaped sequence (e.g., \x3cimg onerror=...\x3e) that sanitize_textarea_field does not strip, and is only decoded back into a live HTML tag by stripcslashes() during admin rendering — after all sanitization has occurred.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_