The PDF Poster plugin for WordPress stores unsanitized user input, allowing an attacker to embed malicious JavaScript that is later rendered in browsers. This stored XSS flaw can compromise the confidentiality, integrity, and availability of the site by executing code in the context of any visitor who accesses the affected content. Based on the description, it is inferred that attackers would likely need to inject malicious payloads through the plugin’s data entry mechanisms, which may require authenticated access or the ability to influence stored content.

The issue exists in all releases of bPlugins PDF Poster from the earliest version through 2.6.1. Upgrading to at least version 2.6.2 eliminates the vulnerability.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, suggesting limited public exploitation data. The flaw is not listed in CISA’s KEV catalog. Once the attacker injects malicious input via the plugin, the script runs with the privileges of any visitor to the site, making the vulnerability moderate in exploitability but still significant for exposed users.