CVE-2026-42681
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.
Risk Assessment
An attacker can send a specially crafted link to a victim; when clicked, it executes a malicious script in the site context, enabling data or session theft.
Recommendation
Update the e2pdf plugin to version 1.32.15 or later, which includes input neutralization fixes.
Other vulnerabilities in e2pdf
See all- CVE-2026-111410Medium
The e2pdf plugin up to version 1.32.57 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
- CVE-2026-66710High
Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.
- CVE-2025-62068Medium
The e2pdf WordPress plugin (versions up to and including 1.28.09) contains a cross-site scripting vulnerability due to improper neutralization of input during web page generation. This may allow execution of malicious script in a user's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS