CVE-2026-7650

Vulnerability

Overview The E2Pdf – Export Pdf Tool for WordPress plugin (versions up to and including 1.32.17) contains a Stored Cross-Site Scripting (XSS) vulnerability. It stems from insufficient sanitization and output escaping of the id attribute in the [e2pdf-download] shortcode [1]. When a user creates a page or post using this shortcode, the unsanitized attribute can be used to inject arbitrary JavaScript.

Exploitation

Conditions Exploitation requires an authenticated attacker with at least Contributor-level permissions, which allows them to create and publish content. The attacker can add a malicious [e2pdf-download id=""><script>alert('XSS')</script>"] shortcode in a page or post. Any user (including administrators) who views the affected page will execute the injected script in their browser [1]. The attack does not require any special network access beyond standard WordPress usage.

Impact

Successful exploitation results in full stored XSS execution. An attacker can steal session cookies, perform actions on behalf of the victim, deface pages, or redirect users to malicious sites. Since the script executes in the context of the WordPress admin area for logged-in users, privilege escalation to administrator is possible by forging requests (CSRF chaining) [1].

Mitigation

The vendor has not yet released a patched version as of the CVE publication date (2026-05-08). Users should restrict Contributor and higher roles to trusted users, remove the shortcode from untrusted content, or apply a web application firewall rule to block malicious id values until an update is available [1].