The vulnerability appears as an improper neutralization of input during web page generation, allowing a stored XSS attack. An attacker can inject malicious JavaScript that will be executed in the browsers of anyone viewing the compromised content. The effect can include defacement, cookie theft, or redirection, thereby compromising confidentiality, integrity, or availability of user sessions.

Pdfcrowd Dev Team’s Save as PDF plugin for WordPress, versions 4.5.2 and earlier. No additional version constraints are listed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % signals a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit it via the plugin’s data submission interface, requiring no elevated privileges on the site. Although the risk is moderate, the low EPSS suggests limited impact in the wild today. However, if an attacker gains write access through the plugin, they could supply malicious payloads that are rendered for all visitors.