Skip to main content

E2pdf CVE-2024-43318

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2024-08-18 audit@patchstack.com
WordPress XSS E2pdf Wordpress Plugin
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

3
CVSS changed
Apr 23, 2026 - 15:22 NVD
5.4 (MEDIUM) 6.5 (MEDIUM)
CVE Published
Aug 18, 2024 - 15:15 nvd
MEDIUM 5.4
CVE Published
Aug 18, 2024 - 15:15 cve.org
MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.25.05.

AnalysisAI

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.25.05. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.25.05. Affected products include: E2Pdf.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in E2pdf

View all
CVE-2023-5229 MEDIUM POC
4.8 Oct 31

The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high priv
CVE-2022-0535 MEDIUM POC
4.8 Mar 07

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high priv
CVE-2023-6826 HIGH
7.2 Dec 15

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the '
CVE-2026-66710 HIGH
8.1 Aug 06

Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote
CVE-2023-50849 HIGH
7.6 Dec 28

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf -

CVE-2023-46154 MEDIUM
6.6 Dec 19

Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.18. Rated mediu
CVE-2024-31373 MEDIUM
5.4 Apr 15

Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulne
CVE-2024-37415 MEDIUM
5.4 Nov 01

Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2026-32442 MEDIUM
5.0 Mar 13

E2Pdf versions through 1.28.15 contain a missing authorization vulnerability that allows authenticated users to modify d

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2024-43318 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy