What is the CVSS score of CVE-2026-7650?

CVE-2026-7650 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

E2Pdf Export Pdf Tool CVE-2026-7650

EUVD-2026-28544 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 Wordfence

GHSA-hr4j-j5wc-96jv

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 10:30 vuln.today

CVE Published

May 08, 2026 - 09:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The E2Pdf - Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in E2Pdf - Export Pdf Tool for WordPress plugin versions up to 1.32.17 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'id' attribute of the e2pdf-download shortcode, which executes when any user views the affected page. The vulnerability stems from insufficient input sanitization and output escaping on shortcode attributes, enabling persistent script injection with moderate confidentiality and integrity impact across site scopes.

Technical ContextAI

E2Pdf is a WordPress plugin that provides PDF export functionality via shortcodes. The vulnerability exists in the e2pdf-shortcode.php model class, specifically in the handling of the 'id' attribute within the [e2pdf-download] shortcode. The plugin fails to properly sanitize user input from the shortcode attribute and does not adequately escape output when rendering the shortcode. This is a Stored XSS (CWE-79) vulnerability because the malicious payload is persisted in the WordPress database (via page/post content) and executed server-side when the shortcode is processed, affecting all visitors to that page. The root cause is the absence of both input validation (sanitization) and output encoding (escaping) functions typically provided by WordPress security APIs such as sanitize_text_field() or wp_kses_post() for input, and esc_attr() or esc_html() for output.

RemediationAI

Update E2Pdf to version 1.32.18 or later, which includes fixes to the shortcode attribute handling as evidenced by code changes in the plugin repository commit 3522046. Site administrators should navigate to WordPress Admin Dashboard → Plugins → Installed Plugins, locate E2Pdf, and click 'Update Now' to apply the patched version. If immediate patching is not possible, implement compensating controls: restrict Contributor role assignment to trusted users only, review existing page and post content for malicious e2pdf-download shortcodes with suspicious 'id' attributes (look for script tags or event handlers), and disable the e2pdf-download shortcode plugin-wide using a code snippet or security plugin if the PDF export feature is not actively used. Note that disabling the shortcode prevents legitimate PDF exports until the plugin is patched. Audit WordPress user roles and audit logs to identify any unauthorized shortcode injections or suspicious Contributor account activity.