{"id":"CVE-2026-48195","kind":"vulnerability","aliases":["CVE-2026-48195"],"related":[],"title":"PDF Poster WordPress plugin: stored XSS through 2.6.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.","summary":"The PDF Poster plugin for WordPress, by bPlugins, fails to neutralize input before writing it into web pages. An attacker who can store content in the plugin can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pdf-poster","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `pdf-poster` plugin in the WordPress admin under Plugins.\n- Confirm whether the installed version is `2.6.1` or earlier.","fix":"- Move `PDF Poster` past `2.6.1`; no fixed version is named in the sources.","status":"open","published_at":"2026-10-29T14:17:55+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:01+00:00","updated_at":"2026-10-29T14:26:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T14:26:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move `PDF Poster` past `2.6.1`; no fixed version is named in the sources.","reach":"internet","title":"PDF Poster WordPress plugin: stored XSS through 2.6.1","impact":"medium","summary":"The PDF Poster plugin for WordPress, by bPlugins, fails to neutralize input before writing it into web pages. An attacker who can store content in the plugin can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pdf-poster"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"scripts run in other visitors' browsers on the site","analyst_note":"Confirm the fixed version and which user role can store the input, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48195.","how_to_check":"- Check the installed version of the `pdf-poster` plugin in the WordPress admin under Plugins.\n- Confirm whether the installed version is `2.6.1` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PDF Poster plugin at version 2.6.1 or earlier. The sources do not say which roles can store the input, so treat any site where untrusted users can submit content as exposed. Sites that do not run the plugin are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4121,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-48195':11A,14A '2.6.1':8A,84C 'affect':78C 'allow':74C 'attack':39B 'bplugin':27B,68C 'browser':53B 'content':43B 'cross':63C 'cross-sit':62C 'cve':9A,12A 'fail':28B 'generat':61C 'improp':54C 'input':31B,57C 'issu':77C 'n/a':82C 'neutral':30B,55C 'packag':15B 'page':37B,60C 'pdf':1A,17B,21B,69C,72C,79C 'pdf-poster':16B,71C 'plugin':4A,23B,46B 'poster':2A,18B,22B,70C,73C,80C 'run':48B 'script':49B,65C 'site':64C 'store':5A,42B,75C 'visitor':52B 'vulner':66C 'web':36B,59C 'wordpress':3A,19B,25B 'write':33B 'xss':6A 'xss.this':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PDF Poster plugin at version 2.6.1 or earlier. The sources do not say which roles can store the input, so treat any site where untrusted users can submit content as exposed. Sites that do not run the plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48195","severity":null,"published_at":"2026-10-29T14:17:55+00:00","modified_at":"2026-10-29T14:17:55+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}