CVE-2026-111410
MediumCVSS 6.5Summary
The e2pdf plugin up to version 1.32.57 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
Risk Assessment
An attacker could execute arbitrary script in the context of an administrator or user session, potentially leading to data theft or account takeover.
Recommendation
Update the e2pdf plugin to a version later than 1.32.57 and enforce input validation.
Other vulnerabilities in e2pdf
See all- CVE-2026-66710High
Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.
- CVE-2026-42681High
The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
- CVE-2025-62068Medium
The e2pdf WordPress plugin (versions up to and including 1.28.09) contains a cross-site scripting vulnerability due to improper neutralization of input during web page generation. This may allow execution of malicious script in a user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS