CVE-2026-48195
MediumCVSS 6.5Summary
The PDF Poster WordPress plugin (pdf-poster) through version 2.6.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious script can be persistently stored and executed for users.
Risk Assessment
The stored script can execute in visitors' browsers, enabling admin session hijacking or content modification. The risk affects sites with the vulnerable plugin version.
Recommendation
Update the PDF Poster plugin to a version later than 2.6.1. Review and remove any malicious content stored on the site.
Other vulnerabilities in PDF Poster
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS