Live › vulnerability › CVE-2026-111410
Go to dashboardThe e2pdf plugin by E2Pdf.com does not neutralize input when generating web pages, which allows stored cross-site scripting. An attacker who can store content in the plugin can run script in the browser of anyone who views that content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run the e2pdf plugin at version or older are affected, as the description states the issue affects all versions through that release. Sites without the plugin installed can skip it. The sources do not say which roles can store content or whether default settings expose it.
1.32.57No product ranges from the sources yet.
1.32.57 or older1.32.57 once a fixed release is published; the sources do not name itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
This page as .md · .json · in your agent: get_signal("CVE-2026-111410")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.