CVE-2026-73190
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in WPDM – Premium Packages versions up to 7.0.5. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Potential session theft, account takeover, or malware distribution.
Recommendation
Update WPDM – Premium Packages to a version that includes the fix.
Other vulnerabilities in WPDM – Premium Packages
See all- CVE-2026-61943High
The WPDM – Premium Packages plugin up to version 6.2.0 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can bypass authorization mechanisms and gain unauthorized access to functions or data.
- CVE-2026-61948Critical
The WPDM – Premium Packages plugin versions up to 6.2.0 are vulnerable to unauthenticated SQL injection.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS