Stored Cross-Site Scripting Vulnerability in Save as PDF Plugin

CVE-2024-10891

Summary

The Save as PDF Plugin by Pdfcrowd for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the 'save_as_pdf_pdfcrowd' shortcode. This issue arises from the plugin's failure to properly sanitize user-supplied input and escape output, which affects all versions up to and including 4.2.1. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts will execute when users access the compromised pages, potentially leading to session hijacking, defacement, or the installation of malicious content. It is crucial for website administrators using this plugin to apply appropriate security measures and updates to mitigate the risk of exploitation.

References