The vulnerability is an unauthenticated cross‑site scripting flaw in the WordPress WPDM – Premium Packages plugin. Attackers can inject arbitrary script into pages served by the site, potentially allowing the execution of malicious code in the context of the victim’s browser. This is a classic input‑validation weakness identified as CWE‑79 and can lead to cookie theft, session hijacking, defacement, or other client‑side compromise for anyone who views the vulnerable page.

The flaw affects installations of the Shahjada WPDM – Premium Packages plugin with version numbers up to and including 7.0.5. Users running those or earlier versions are at risk until they update to a later revision.

The CVSS score of 7.1 categorises the risk as medium‑high, indicating significant potential impact. The EPSS score is not available, which does not preclude exploitation but means the current probability of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalogue. Based on the description, the attack vector is unauthenticated; any user can inject malicious script through unfiltered input fields in the plugin, and the flaw does not require privileged access.