Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93654 · Microsoft / collected KEV context

cve-program · CVE-2026-93654

• https://www.wordfence.com/threat-intel/vulnerabilities/id/38e3a2a4-3d35-4de9-9b44-568eab0c44f6?source=cve
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/templates/invoices/default/invoice.php#L167
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/includes/libs/cart-functions.php#L483
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartService.php#L328
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Cart/CartItem.php#L96
• https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/7.2.1/src/Order/OrderService.php#L1255
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3708519%40wpdm-premium-packages&new=3708519%40wpdm-premium-packages

No related operational record is retained in the current change model.