Improper neutralization of input during web page generation allows a stored XSS flaw in the e2pdf WordPress plugin. The flaw, identified as CWE‑79, can enable an attacker to inject malicious scripts that execute in the browsers of anyone who views affected pages, potentially facilitating session hijacking, defacement, or unauthorized data exfiltration. The attack likely involves a privileged user submitting malicious content stored by the plugin. Based on the description, it is inferred that the attacker can inject scripts that execute in browsers of anyone who views affected pages.

The vulnerability affects the e2pdf plugin from E2Pdf.com for WordPress, with all releases from the earliest documented version through 1.32.57 being impacted. Users running any of these versions should assess their environment for the plugin’s presence.

The CVSS score of 6.5 indicates a medium risk level. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. The flaw requires that malicious input be stored by the plugin—likely through privileged or content‑authoring actions—and later rendered in a web page, thereby executing in visitors’ browsers. Attack feasibility is therefore contingent on the plugin’s configuration and user permissions, but once present it can compromise all site visitors who access the affected content. Based on the description, it is inferred that exploitation requires that the malicious data be submitted by an authorized content author and subsequently rendered in a generated page.