The vulnerability is a stored cross‑site scripting flaw in the E2Pdf WordPress plugin that allows an authenticated user with Contributor role or higher to inject arbitrary JavaScript via the id attribute of the e2pdf-download shortcode. The attacker can store malicious scripts in the database; any visitor who loads a page containing the shortcode will execute the injected code. This can lead to defacement, session hijacking, cookie theft, and other client‑side compromises, affecting confidentiality, integrity, and availability of the site for users.

The flaw affects all installations of the E2Pdf – Export Pdf Tool for WordPress plugin with a version of 1.32.17 or earlier. No other products or versions are impacted at the time of this analysis.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV. An attacker must be logged in with Contributor or higher privileges to exploit the flaw. The attack path requires the attacker to create or edit a post or page, insert the vulnerable shortcode with a malicious id value, and then have other site visitors load the page. This stored payload remains until the shortcode is removed or the plugin is upgraded. There is no publicly reported active exploitation activity indicated by KEV, but the moderate CVSS and the need for authenticated access make timely remediation advisable.