The Save as PDF Button plugin for WordPress contains a stored cross‑site scripting flaw in the restpackpdfbutton shortcode. Unsanitized user‑supplied attributes allow authenticated contributors or higher to embed arbitrary JavaScript in the generated output. When a site visitor loads a page that contains the injected shortcode, the malicious script runs in the visitor’s browser, enabling phishing, credential theft, or other client‑side attacks.

All installations of the Save as PDF Button WordPress plugin, version 1.9.2 and earlier, are affected. This includes any WordPress site that has deployed the plugin with those versions.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % suggests low probability of exploitation. The vulnerability is not in the CISA KEV catalog. The attack requires contributor‑level or higher authentication; once an attacker has such access, they can craft a malicious shortcode and add it to a page or post, storing the script for all future visitors. Exploitation can lead to client‑side attacks and possible session compromise.