The Save as PDF Plugin by PDFCrowd is vulnerable to reflected cross‑site scripting through the unsanitized options parameter. An attacker can embed malicious JavaScript in a crafted URL; if a user follows that link while the plugin is in demo mode (or the attacker knows the API key), the script executes in the victim’s browser. This allows an unauthenticated attacker to run arbitrary code within the context of the site’s web page.

All WordPress installations that use the Save as PDF Plugin by PDFCrowd and have a version of 4.5.5 or earlier are affected. The vulnerability exists in every release up to and including version 4.5.5, regardless of the WordPress core version.

The CVSS score of 6.1 reflects moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation at this time. The vulnerability is not included in CISA’s KEV catalog. Successful exploitation requires that the plugin be operating in demo mode (blank API key) or that the attacker already knows the API key, and it requires user interaction to trigger the malicious script.