CVE-2026-73190

HighCVSS 7.1/10Last modified Oct 22, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-731916.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authent CVE-2026-731926.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getVali CVE-2026-731939.8DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size compu CVE-2026-731949.1DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in p CVE-2026-731957.3Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in o CVE-2026-731966.5A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password CVE-2026-731977.5A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to th CVE-2026-731987.5A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending CVE-2026-731996.5A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by CVE-2026-73207.5Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, F CVE-2026-732087.4An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a s CVE-2026-732096.5An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The