This vulnerability results from improper neutralization of user input during web page generation in the E2Pdf e2pdf WordPress plugin. The flaw allows malicious script code to be incorporated into pages served by the plugin, creating a classic Cross‑Site Scripting condition that can be triggered when a victim visits a crafted page or submits data that is rendered by the plugin.

Any WordPress site that has the E2Pdf e2pdf plugin version 1.28.09 or earlier installed is affected. The issue is present in all releases from the start of the plugin’s version history up through 1.28.09; the starting affected version is not specified, so all sites using these or older releases should assume the flaw exists.

The CVSS score of 6.5 indicates moderate risk, while an EPSS score below 1% suggests that exploitation is currently rare. The vulnerability is not listed in CISA KEV. The attack vector is client‑side XSS, inferring that an attacker would need a victim to visit a crafted URL or submit malicious data that reaches the plugin’s rendering path. No specific exploitation conditions are detailed beyond that requirement.