{"id":"CVE-2026-125764","kind":"vulnerability","aliases":["CVE-2026-125764"],"related":[],"title":"e2pdf WordPress plugin: stored XSS through versions 1.32.65","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.65.","summary":"The e2pdf plugin by E2Pdf.com does not neutralize input before generating web pages, so stored cross-site scripting is possible. An attacker who can store crafted content can run scripts in the browsers of users who view that page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"e2pdf","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["e2pdf","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `e2pdf` plugin is installed and its version in the plugin list or the plugin's main file header","fix":"- Versions through `1.32.65` are affected; the sources do not state a fixed version","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:32+00:00","updated_at":"2026-11-15T14:37:32+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-15T14:37:32Z","model":"claude-haiku-5-5","output":{"fix":"- Versions through `1.32.65` are affected; the sources do not state a fixed version\n- unknown","reach":"network","title":"e2pdf WordPress plugin: stored XSS through versions 1.32.65","impact":"medium","summary":"The e2pdf plugin by E2Pdf.com does not neutralize input before generating web pages, so stored cross-site scripting is possible. An attacker who can store crafted content can run scripts in the browsers of users who view that page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["e2pdf","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers, possibly stealing sessions","analyst_note":"Confirm the platform (WordPress plugin?), the fixed version, and whether authentication is required, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125764 or the vendor advisory.","how_to_check":"- Check whether the `e2pdf` plugin is installed and its version in the plugin list or the plugin's main file header\n- unknown whether other install paths or products are affected","plain_action":"","product_name":"e2pdf","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"The sources describe the e2pdf product from n/a through 1.32.65 and do not name the platform, so it is unknown whether this is a WordPress plugin or another product. Teams running e2pdf versions up to 1.32.65 should review whether users can store content that other users view. Sites not running e2pdf are not affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4548,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125764':11A,14A '-2026':10A,13A '1.32.65':8A,85C 'affect':80C 'allow':76C 'attack':41B 'browser':52B 'content':46B 'craft':45B 'cross':35B,68C 'cross-sit':34B,67C 'cve':9A,12A 'e2pdf':1A,15A,16B,20B,74C,75C,81C 'e2pdf.com':23B,73C 'generat':29B,66C 'improp':59C 'input':27B,62C 'issu':79C 'n/a':83C 'neutral':26B,60C 'page':31B,58B,65C 'plugin':3A,21B 'possibl':39B 'run':48B 'script':37B,49B,70C 'site':36B,69C 'store':4A,33B,44B,77C 'user':54B 'version':7A 'view':56B 'vulner':71C 'web':30B,64C 'wordpress':2A,18B 'xss':5A 'xss.this':78C","nicknames":[],"mitigations":[],"who_affected":"The sources describe the e2pdf product from n/a through 1.32.65 and do not name the platform, so it is unknown whether this is a WordPress plugin or another product. Teams running e2pdf versions up to 1.32.65 should review whether users can store content that other users view. Sites not running e2pdf are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["e2pdf"],"ptokens":["e2pdf"],"labels":["e2pdf","high","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-125764':11A,14A '-2026':10A,13A '1.32.65':8A 'cve':9A,12A 'e2pdf':1A,15A 'plugin':3A 'store':4A 'version':7A 'wordpress':2A 'xss':5A","search_b":"'attack':41B 'browser':52B 'content':46B 'craft':45B 'cross':35B 'cross-sit':34B 'e2pdf':16B,20B 'e2pdf.com':23B 'generat':29B 'input':27B 'neutral':26B 'page':31B,58B 'plugin':21B 'possibl':39B 'run':48B 'script':37B,49B 'site':36B 'store':33B,44B 'user':54B 'view':56B 'web':30B 'wordpress':18B","search_c":"'1.32.65':85C 'affect':80C 'allow':76C 'cross':68C 'cross-sit':67C 'e2pdf':74C,75C,81C 'e2pdf.com':73C 'generat':66C 'improp':59C 'input':62C 'issu':79C 'n/a':83C 'neutral':60C 'page':65C 'script':70C 'site':69C 'store':77C 'vulner':71C 'web':64C 'xss.this':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125764","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}