CVE-2025-62068
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The e2pdf WordPress plugin (versions up to and including 1.28.09) contains a cross-site scripting vulnerability due to improper neutralization of input during web page generation. This may allow execution of malicious script in a user's browser.
Risk Assessment
An attacker could execute arbitrary script in a victim's browser context, risking session theft or content modification. WordPress sites with the vulnerable plugin version are at risk.
Recommendation
Update the e2pdf plugin to a version later than 1.28.09. Verify whether the plugin is still needed and sourced from a trusted provider.
Other vulnerabilities in e2pdf
See all- CVE-2026-111410Medium
The e2pdf plugin up to version 1.32.57 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2026-66710High
Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.
- CVE-2026-42681High
The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS