---
id: "CVE-2026-48195"
kind: "vulnerability"
aliases: ["CVE-2026-48195"]
title: "PDF Poster WordPress plugin: stored XSS through 2.6.1"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pdf-poster", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T14:17:55+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48195", "first_seen_at": "2026-10-29T14:25:23+00:00"}]
---

# PDF Poster WordPress plugin: stored XSS through 2.6.1

The PDF Poster plugin for WordPress, by bPlugins, fails to neutralize input before writing it into web pages. An attacker who can store content in the plugin can run scripts in other visitors' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `pdf-poster` plugin in the WordPress admin under Plugins.
- Confirm whether the installed version is `2.6.1` or earlier.

## Fix

- Move `PDF Poster` past `2.6.1`; no fixed version is named in the sources.

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48195

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_