The pdfl.io plugin for WordPress is vulnerable to stored cross‑site scripting caused by insufficient sanitization of the 'text' attribute in the 'pdflio' shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary HTML and JavaScript, leading to malicious script execution when any visitor loads a page that contains the compromised shortcode. This can be used to steal session cookies, deface content, or redirect users to phishing sites. The flaw resides in the output_shortcode() function, which concatenates the user‑supplied $text variable without employing escaping functions such as esc_html(), aligning with CWE‑79 for unvalidated input.

The vulnerability affects the pdfl.io WordPress plugin developed by Doug Black Jr. All releases up to and including version 1.0.5 are impacted. WordPress sites that have installed any of these versions and have users with Contributor or higher roles are susceptible.

The CVSS score of 6.4 indicates medium severity, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitability is limited to authenticated users with Contributor or higher privileges, which means a site with weak role assignment or compromised account can be used as an attack surface. An attacker can inject persistent scripts into content that will run in the browsers of all visitors, enabling credential theft or site defacement. While the direct vector requires authentication, the damage can affect all site users once the malicious content is served.