E2Pdf CVE-2025-62068

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) on a site running the E2Pdf plugin version n/a through 1.28.09, plus victim user interaction (UI:R) - a privileged user or other victim must view the page containing the injected, improperly neutralized input for the script to execute. The attack is limited by these two factors: the attacker cannot be fully unauthenticated, and the payload is inert until a victim loads the affected content, so an account-provisioning or self-registration path to a low-privilege role is a practical prerequisite for opportunistic attackers.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in the E2Pdf WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent and point to a low-to-moderate real-world priority rather than an urgent one. The network attack vector and low complexity ease exploitation, but two meaningful constraints temper the risk: PR:L requires the attacker to already hold an authenticated low-privilege account on the WordPress site, and UI:R means a victim must perform an action (e.g., visit a page or open an admin view) for the payload to fire. EPSS corroborates the modest threat level at 0.18% (7th percentile), indicating very low predicted exploitation activity. There is no CISA KEV listing and no public exploit code referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The S:C (scope change) and the low Confidentiality/Integrity/Availability impacts are typical of XSS, where injected script executes in another user's browser session rather than compromising the server directly. Net assessment: a legitimate issue worth patching, but it is a high-CVSS-relative-to-actual-threat case - the authentication prerequisite, required user interaction, and near-floor EPSS make widespread opportunistic exploitation unlikely. No signals conflict; the main limiter is the PR:L requirement.

An attacker holding a low-privileged authenticated account (e.g., contributor or author) on a WordPress site running E2Pdf ≤ 1.28.09 injects a malicious script payload into a plugin input field that is not properly neutralized during page generation. When an administrator or another user subsequently views the affected page, the script executes in their browser session, potentially enabling session hijacking, actions on their behalf, or defacement. No public exploit code is referenced, and successful exploitation depends on the victim viewing the tainted content (UI:R).