CVE-2026-42681

Vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability in the E2Pdf.Com e2pdf plugin for WordPress. The issue stems from improper neutralization of user input during web page generation. Affects versions from n/a through 1.32.14 [1].

Exploitation

An attacker can craft a malicious link or request that, when a privileged user (e.g., administrator) clicks or interacts with it, executes arbitrary JavaScript in the context of the vulnerable site. User interaction is required; the attacker does not need authentication but relies on a privileged user performing an action [1].

Impact

Successful exploitation allows an attacker to inject malicious scripts, such as redirects, advertisements, and other HTML payloads, which are executed when visitors access the affected website. This can lead to information disclosure, session hijacking, or defacement [1].

Mitigation

Update the plugin to version 1.32.15 or later, released to resolve the vulnerability. If unable to update, use a vulnerability mitigation rule from Patchstack to block attacks until the patch is applied. [1]