CVE-2026-73190: WPDM Premium Packages XSS Vulnerability

CVE-2026-73190 Overview

CVE-2026-73190 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress WPDM – Premium Packages plugin in versions up to and including 7.0.5. The flaw is classified under [CWE-79], improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in a victim's browser when they interact with a crafted request or link. Because the attack crosses a security scope boundary, successful exploitation can affect other components beyond the vulnerable plugin context.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and administrative account takeover on WordPress sites running WPDM – Premium Packages 7.0.5 or earlier.

Affected Products

WPDM – Premium Packages WordPress plugin, versions <= 7.0.5
WordPress sites using the vulnerable plugin for premium download management
Any WordPress environment that permits public access to plugin-rendered endpoints

Discovery Timeline

2026-08-18 - CVE-2026-73190 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73190

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting flaw in the WPDM – Premium Packages plugin, a commercial extension of the WordPress Download Manager ecosystem. The plugin fails to properly neutralize user-supplied input before returning it in HTML responses. An attacker crafts a request containing JavaScript payloads that the plugin renders without adequate encoding or sanitization.

Exploitation requires user interaction, typically a victim clicking a malicious link or visiting an attacker-influenced page. Once the payload executes in the victim's browser, it runs in the context of the vulnerable WordPress site. If the victim is an authenticated administrator, the payload can perform privileged actions such as creating new admin accounts, modifying plugin settings, or injecting persistent backdoors.

The scope change indicated in the CVSS vector means impact extends beyond the vulnerable component, affecting the wider browser session and any resources trusted by the site origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Plugin code paths that echo or render user-controlled parameters lack context-aware output encoding, allowing HTML and JavaScript syntax to break out of intended data contexts and execute as script.

Attack Vector

The attack is delivered over the network and requires no authentication. The attacker crafts a URL or form submission containing a JavaScript payload targeting a vulnerable plugin endpoint. Delivery mechanisms include phishing emails, malicious advertisements, or attacker-controlled web pages that redirect victims to the crafted request. When a WordPress administrator interacts with the payload, the injected script executes with the privileges of the administrator's active session.

No verified proof-of-concept code is publicly documented. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-73190

Indicators of Compromise

Web server access logs containing requests to WPDM – Premium Packages endpoints with URL-encoded <script>, javascript:, onerror=, or onload= payloads
Unexpected WordPress administrator accounts, modified user roles, or new plugin installations following suspicious traffic
Outbound browser requests from administrator workstations to unfamiliar domains after visiting WordPress admin pages
WordPress database entries containing HTML or JavaScript in fields normally holding plain text metadata

Detection Strategies

Inspect HTTP request parameters sent to /wp-content/plugins/wpdm-premium-packages/ paths for reflected script content in response bodies
Deploy a Web Application Firewall (WAF) rule set that flags common XSS payload signatures against WordPress plugin endpoints
Correlate reflected input across request and response pairs in application logs to identify successful injection attempts

Monitoring Recommendations

Enable WordPress audit logging to record administrator actions, user creation events, and plugin configuration changes
Monitor Content Security Policy (CSP) violation reports for inline script executions from the WordPress origin
Alert on anomalous session activity for privileged WordPress accounts, including logins from new IP addresses or user agents

How to Mitigate CVE-2026-73190

Immediate Actions Required

Identify all WordPress sites running WPDM – Premium Packages and confirm the installed version against the vulnerable range <= 7.0.5
Update the plugin to a patched release once the vendor publishes a fixed version referenced in the Patchstack advisory
Rotate WordPress administrator credentials and invalidate active sessions on any site that processed suspicious traffic
Review recent administrator activity logs for unauthorized user creation, role changes, or plugin modifications

Patch Information

Refer to the Patchstack WordPress Vulnerability advisory for the current patch status and fixed version details. Apply the vendor-supplied update through the WordPress plugin management interface as soon as it is available.

Workarounds

Deploy WAF rules that block requests containing common XSS payloads targeting WPDM – Premium Packages endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Temporarily disable the WPDM – Premium Packages plugin on sites where patching cannot be applied immediately
Restrict administrator access to trusted IP ranges using WordPress access control plugins or web server configuration

bash

# Example: temporarily disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate wpdm-premium-packages

# Example: verify installed plugin version
wp plugin get wpdm-premium-packages --field=version