Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.
Published: 2025-01-07
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of input during web page generation enables stored cross‑site scripting in the JK Html To Pdf plugin. This vulnerability is classified as CWE-79 and allows an attacker to inject arbitrary scripts into stored content.

Affected Systems

All WordPress installations that use the JK Html To Pdf plugin version 1.0.0 or earlier are affected. The vulnerability covers the entire product range from the first release up to, and including, 1.0.0.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium-to-high severity impact. The EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw via CSRF to store malicious content that may later be accessed by site users.

Generated by OpenCVE AI on May 2, 2026 at 06:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the JK Html To Pdf plugin to the latest version released by jaykrishnang or apply any vendor‑supplied patch that addresses the stored XSS flaw.
  • If an update is not immediately available, disable the plugin or restrict its use to trusted administrators only until a fix can be deployed.
  • As a temporary workaround, validate and sanitize all user‑supplied input before it is processed by the plugin; implement server‑side filtering and configure a Content‑Security‑Policy that blocks inline script execution in generated PDFs.

Generated by OpenCVE AI on May 2, 2026 at 06:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-2825 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jay Krishnan G JK Html To Pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through 1.0.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jay Krishnan G JK Html To Pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through 1.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 07 Jan 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jan 2025 15:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jay Krishnan G JK Html To Pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through 1.0.0.
Title WordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:01.601Z

Reserved: 2025-01-07T10:23:17.401Z

Link: CVE-2025-22547

cve-icon Vulnrichment

Updated: 2025-01-07T16:40:06.712Z

cve-icon NVD

Status : Deferred

Published: 2025-01-07T16:15:50.463

Modified: 2026-06-17T08:48:10.480

Link: CVE-2025-22547

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T07:00:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')