Live › vulnerability › CVE-2026-48195
The PDF Poster plugin for WordPress, by bPlugins, fails to neutralize input before writing it into web pages. An attacker who can store content in the plugin can run scripts in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the PDF Poster plugin at version 2.6.1 or earlier. The sources do not say which roles can store the input, so treat any site where untrusted users can submit content as exposed. Sites that do not run the plugin are not affected.
No product ranges from the sources yet.
pdf-poster plugin in the WordPress admin under Plugins.2.6.1 or earlier.PDF Poster past 2.6.1; no fixed version is named in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-48195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.