Stored XSS via guest order email

Stored XSS in WPDM – Premium Packages before 7.0.6 allows remote attackers to execute script in an administrator's browser. The guest billing update endpoint accepted an order_email value from unauthenticated requests and stored it, and the admin orders list later rendered customer name and email fields without output escaping. Exploitation requires guest checkout or another reachable guest billing path and an administrator viewing the orders list, yielding browser-side actions or data theft in that session rather than server-side code execution.