Description

Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:02.203Z",
  "pubdate": "2026-08-18T15:17:02.203Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the WPDM – Premium Packages plugin, specifically affecting versions 7.0.5 and prior. This security flaw enables remote, unauthenticated threat actors to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the affected software.\nThe primary impact of this vulnerability involves the execution of arbitrary script code in the context of a victim's browser session. If successfully exploited, an attacker can hijack user sessions, steal sensitive authentication tokens, deface web pages, or redirect users to malicious third-party destinations.\nThe affected product is WPDM – Premium Packages <= 7.0.5 versions. The risk implications are severe for deployments utilizing these versions, as the lack of authentication requirements significantly lowers the barrier to entry for malicious actors.\nExploitation requires no prior authentication or privileged access within the application. An attacker only needs network exposure to the vulnerable endpoint and a mechanism to deliver the malicious payload, typically via crafted URLs or input fields that fail to properly sanitize or encode user-supplied data before rendering it in the Document Object Model (DOM).",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and output encoding within the WPDM – Premium Packages plugin <= 7.0.5 versions. Web applications handling user-supplied parameters must rigorously validate, sanitize, and contextually escape all data before reflecting it back to the client browser. The vulnerable component fails to properly neutralize executable content, allowing malicious input to be processed as trusted markup.\nThe vulnerability is exposed over the network, requiring no authentication or privilege requirements to trigger. An unauthenticated attacker can craft a malicious HTTP request containing the payload designed to exploit the missing output encoding. When a victim interacts with the crafted link or the application processes the unsanitized input, the payload is embedded directly into the server response.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious URL or input payload containing arbitrary JavaScript enclosed in HTML tags or event handlers. Second, the attacker induces a target user to access the malicious link or endpoint. Third, the server processes the request and reflects the unsanitized payload within the HTTP response without applying appropriate HTML or JavaScript encoding. Fourth, the victim's browser receives the response and parses the injected payload as part of the trusted DOM.\nThe payload behavior involves executing in the security context of the victim's browser session. Because the script executes within the victim's session, the post-exploitation impact includes the potential theft of session cookies, localStorage data, or authorization tokens. Furthermore, the script can perform unauthorized actions on behalf of the user, modify the DOM to display phishing interfaces, or pivot to further client-side attacks against the underlying web application."
}