CVE-2026-73190
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The WPDM – Premium Packages plugin (W3 Eden) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects WPDM – Premium Packages from n/a through 7.0.5.
Risk Assessment
An attacker can execute arbitrary script in a logged-in user's browser, potentially leading to session theft or admin account takeover.
Recommendation
Update the WPDM – Premium Packages plugin to a version later than 7.0.5 and consider deploying a Content-Security-Policy header.
Other vulnerabilities in WPDM – Premium Packages
See all- CVE-2026-61948Critical
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
- CVE-2026-61943High
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS