The Print, PDF, Email by PrintFriendly WordPress plugin contains a stored cross‑site scripting vulnerability that allows any authenticated user with administrator-level privileges to inject arbitrary JavaScript through the content_position_css parameter. The unsanitized input is later output in page content, giving an attacker the ability to execute code in the browsers of all site visitors, potentially stealing session cookies, injecting phishing content, or delivering further malware. This is a classic input‑validation weakness, identified as CWE‑79.

Any WordPress site running the Print, PDF, Email by PrintFriendly plugin up to and including version 5.5.10 is affected. Site owners should verify the installed plugin version and apply the latest release from the vendor to eliminate the flaw.

The CVSS base score of 4.4 classifies this flaw as moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not found in CISA’s KEV catalog. Exploitation requires prior administrator access, but once a malicious script is stored it runs for every front‑end user, compromising confidentiality and integrity on the client side. Although the likelihood of exploitation is low, the potential damage to users warrants prompt remediation.