CVE-2026-18586: The WordPress Premium Packages XSS You Should Patch This Weekend
There’s a stored XSS sitting in a WordPress plugin you might have installed CVE-2026-18586 is an unauthenticated stored cross-site scripting flaw in the WordPress plugin “Premium Packages – Sell Digital Products Securely”, disclosed on October 15, 2026. Every version up to and including 7.0.5 is affected. The plugin didn’t ship a fix until the same … Read more