E2PDF · CVE-2026-125764 · Other
NO FIX YET · SEE WHAT TO DO
The e2pdf plugin by E2Pdf.com does not neutralize input before generating web pages, so stored cross-site scripting is possible. An attacker who can store crafted content can run scripts in the browsers of users who view that page.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
The sources describe the e2pdf product from n/a through 1.32.65 and do not name the platform, so it is unknown whether this is a WordPress plugin or another product. Teams running e2pdf versions up to 1.32.65 should review whether users can store content that other users view. Sites not running e2pdf are not affected.
Not affected if plugin-not-installed
Who cares e2pdf, wordpress
e2pdf plugin is installed and its version in the plugin list or the plugin's main file header1.32.65 are affected; the sources do not state a fixed versionImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.65.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.