Skip to main content

WPDM Premium Packages EUVDEUVD-2026-60768

| CVE-2026-73190 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-08-18 Patchstack GHSA-242w-mmc3-4r3x
XSS Wpdm Premium Packages
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
6.1 MEDIUM

Network-reachable unauthenticated XSS with scope change; A:N assigned because XSS does not credibly impair plugin or server availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Aug 18, 2026 - 15:12 vuln.today
CVE Published
Aug 18, 2026 - 14:00 cve.org
HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPDM - Premium Packages <= 7.0.5 versions.

AnalysisAI

Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify WordPress site running affected plugin
Delivery
Craft URL embedding XSS payload in vulnerable parameter
Exploit
Deliver link to victim via phishing or watering-hole
Install
Victim loads crafted request in authenticated browser session
C2
Plugin reflects unsanitized input into HTML response
Execute
Injected JavaScript executes in victim's browser context
Impact
Exfiltrate session cookie or perform privileged actions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target WordPress site to have WPDM - Premium Packages version 7.0.5 or earlier installed and active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.1 score captures a meaningful but bounded risk profile: network-reachable, low complexity, and no required privileges are all high-risk signals, but mandatory user interaction (UI:R) is the primary friction point, requiring a victim to actively load attacker-supplied content rather than allowing fully autonomous exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a WordPress site running WPDM - Premium Packages 7.0.5 or earlier, crafts a URL embedding a JavaScript payload into a vulnerable plugin parameter, and distributes the link via phishing email to a logged-in site administrator. When the administrator clicks the link and the unsanitized parameter is reflected in the browser response, the attacker's JavaScript executes in the administrator's authenticated session, exfiltrating the session cookie to an attacker-controlled endpoint or silently creating a rogue admin account.
Remediation The primary remediation is to update WPDM - Premium Packages to the version released after 7.0.5; patch availability is confirmed per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-7-0-5-cross-site-scripting-xss-vulnerability, though an exact fixed version number was not independently confirmed from the provided intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: conduct a complete audit to identify all WordPress instances using WPDM - Premium Packages version 7.0.5 or earlier and immediately disable the plugin if it is not business-critical; for critical deployments, take instances offline from production traffic and deploy Web Application Firewall rules to block requests containing typical XSS payloads directed at plugin endpoints. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wpdm Premium Packages

View all
CVE-2026-61948 CRITICAL
9.3 Jul 23

SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attacker
CVE-2026-61943 HIGH
7.5 Jul 23

Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-60768 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy