The WP Post to PDF Enhanced plugin version 1.1.1 and earlier suffers from a stored cross‑site scripting (XSS) flaw caused by inadequate neutralization of user input before rendering. The vulnerability allows a malicious actor to embed JavaScript that executes when a victim loads a page containing the injected content, potentially hijacking sessions, delivering malware, or compromising credentials. This weakness is classified as CWE‑79, a classic input validation issue.

Beth Tucker Long WP Post to PDF Enhanced plugin, all releases from the initial launch through version 1.1.1 are impacted.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, which further limits current exploitation momentum. Attackers would need to inject malicious payload via an interface that stores the content—likely an editor or custom field—after which any user who views the affected page would be exposed to the script. The attack vector is therefore stored XSS, predicated on the ability to write content that is persisted and displayed later.