This vulnerability (CVE-2026-73190) is an unauthenticated Cross-Site Scripting (XSS) flaw in the WPDM – Premium Packages plugin by Shahjada, affecting versions up to 7.0.5. The issue arises from improper neutralization of input during web page generation, categorized under CWE-79. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability in a scope-changing manner. No known exploits in the wild or vendor patches have been reported as of the publication date.

An unauthenticated attacker can exploit this vulnerability to inject malicious scripts into web pages generated by the affected plugin. Successful exploitation could lead to partial compromise of user confidentiality, integrity, and availability, potentially enabling actions such as session hijacking, defacement, or denial of service. The vulnerability affects the plugin's web interface and requires user interaction to trigger the malicious script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access or disabling the affected plugin if feasible.