E2pdf
Monthly
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.
Stored cross-site scripting in the E2Pdf WordPress plugin through 1.32.57 allows a low-privileged authenticated user to persist malicious input that executes when a higher-privileged victim views the affected page or stored content, potentially within the victim's browser session. The CVSS 3.1 score is 6.5 with a scope change (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for an authenticated account and victim interaction; no public exploit code or CISA KEV entry was identified at time of analysis, making this a moderate rather than critical priority.
E2Pdf versions through 1.28.15 contain a missing authorization vulnerability that allows authenticated users to modify data they should not have access to due to incorrectly configured access control security levels. An attacker with low-level user privileges can exploit this via network access without user interaction to escalate their capabilities and modify unauthorized PDF-related resources. While the CVSS score of 4.3 is moderate and integrity impact is low, the vulnerability represents a classic authorization bypass that could allow privilege escalation or lateral movement within multi-user E2Pdf deployments.
Cross-site scripting in the E2Pdf WordPress plugin through version 1.28.09 allows authenticated attackers with low-level privileges to inject malicious scripts that execute when a victim views the affected page, potentially leading to session hijacking or data theft. Exploitation requires victim interaction, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.18%.
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.25.05. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.23. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.18. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.
Stored cross-site scripting in the E2Pdf WordPress plugin through 1.32.57 allows a low-privileged authenticated user to persist malicious input that executes when a higher-privileged victim views the affected page or stored content, potentially within the victim's browser session. The CVSS 3.1 score is 6.5 with a scope change (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for an authenticated account and victim interaction; no public exploit code or CISA KEV entry was identified at time of analysis, making this a moderate rather than critical priority.
E2Pdf versions through 1.28.15 contain a missing authorization vulnerability that allows authenticated users to modify data they should not have access to due to incorrectly configured access control security levels. An attacker with low-level user privileges can exploit this via network access without user interaction to escalate their capabilities and modify unauthorized PDF-related resources. While the CVSS score of 4.3 is moderate and integrity impact is low, the vulnerability represents a classic authorization bypass that could allow privilege escalation or lateral movement within multi-user E2Pdf deployments.
Cross-site scripting in the E2Pdf WordPress plugin through version 1.28.09 allows authenticated attackers with low-level privileges to inject malicious scripts that execute when a victim views the affected page, potentially leading to session hijacking or data theft. Exploitation requires victim interaction, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.18%.
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.25.05. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.23. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.18. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.