CVE-2026-42681

HighCVSS 7.1

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.

Risk Assessment

An attacker can send a specially crafted link to a victim; when clicked, it executes a malicious script in the site context, enabling data or session theft.

Recommendation

Update the e2pdf plugin to version 1.32.15 or later, which includes input neutralization fixes.

Other vulnerabilities in e2pdf

CVE-2026-66710High
Local File Inclusion (LFI) vulnerability in e2pdf plugin up to version 1.32.40, allowing an unauthenticated attacker to read local files on the server.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.