CVE-2025-59552
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Stored XSS.This issue affects Save as PDF: from n/a through <= 4.5.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in WordPress Save as PDF plugin up to 4.5.2 allows contributors to inject malicious scripts via unsanitized input.
The Save as PDF plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows arbitrary JavaScript to be permanently stored in the application.
An attacker with contributor-level access can inject malicious scripts into posts or pages. When an administrator or any other user views the affected content, the script executes in their browser. The attack does not require any special network position, only the ability to create or edit content [1].
Successful exploitation can lead to session hijacking, forced redirects, defacement, or other malicious actions performed in the context of the victim's session. The vulnerability has a CVSS score of 6.5 (Medium) and is known to be used in mass-exploit campaigns targeting thousands of sites [1].
The issue is resolved in version 4.5.3 of the plugin. Users running version 4.5.2 or earlier should update immediately. Patchstack users can enable auto-updates for vulnerable plugins [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=4.5.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.