Improper neutralization of input during web page generation in the W3 Eden WPDM – Premium Packages plugin allows an attacker to inject unfiltered data into the page’s DOM, enabling DOM‑based Cross‑Site Scripting that can execute arbitrary JavaScript when a user views the affected page. The flaw applies to all plugin versions up to and including 7.0.5. The vulnerability can be leveraged by any user and may allow an attacker to manipulate content presented in the victim’s browser. The weakness is described as CWE‑79.

The flaw affects installations of the W3 Eden WPDM – Premium Packages plugin with version numbers up to and including 7.0.5. Users running those or earlier versions are at risk until they update to a later revision.

The CVSS score of 7.1 categorises the risk as high, indicating significant potential impact. The EPSS score is < 1%, showing a very low, but non‑zero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalogue. Based on the description, it is inferred that the likely attack vector is unauthenticated and does not require privileged access; any user can supply malicious input to the plugin’s unfiltered handling of data.