The vulnerability is an improper neutralization of input during web page generation, allowing a stored cross‑site scripting attack. Because the plugin accepts user‑supplied data that is later rendered without appropriate escaping, an attacker can inject JavaScript that executes in the browser context of any user who views the affected page. This flaw can lead to session hijacking, credential theft, defacement, or other client‑side compromise, jeopardizing confidentiality and integrity.

The issue affects Shahjada’s WPDM – Premium Packages plugin for WordPress versions from the earliest available release up through 6.0.6. Any site that has this plugin installed and is running a version at or below 6.0.6 is vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. The flaw is not yet listed in the CISA KEV catalog. Potential exploitation requires that the attacker can submit data through the plugin interface—most likely an administrator or a user with permissions to use the feature—so that malicious payloads are stored and then displayed to other visitors. The exact attack vector is inferred from the description, as it is not explicitly stated.