Technical impact
The vulnerability is an improper neutralization of input during web page generation that allows a reflected cross‑site scripting attack on the WordPress e2pdf plugin. An attacker can craft a request or link that contains JavaScript, which will be executed in the browser of any user who follows the link or submits the input. The flaw enables execution of arbitrary client‑side code within the victim’s browser, which may be used for page manipulation or data exfiltration within the session. The vulnerability is classified as CWE‑79.
Affected Systems
The affected product is the WordPress e2pdf plugin from E2Pdf.com. All installations using version 1.32.14 or earlier are vulnerable. The plugin is distributed through the WordPress ecosystem and can typically be installed via the plugins screen in a WordPress site.
Risk and Exploitability
The CVSS score is 7.1, indicating a high severity level. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting no known public exploits yet. The likely attack vector is web‑based, leveraging a reflected input in the URL or form data. Based on the description, it is inferred that exploitation requires a user to visit the crafted URL or interact with the plugin’s input field, making it a client‑side vulnerability that can be triggered by social engineering or phishing.
