Cross-site Scripting Vulnerability in WP Advanced PDF by CedCommerce
CVE-2025-57945

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Advanced PDF
Vendor
CVE Published:
22 September 2025

What is CVE-2025-57945?

A Cross-site Scripting (XSS) vulnerability exists in the CedCommerce WP Advanced PDF plugin, allowing attackers to inject malicious scripts via improperly neutralized input during web page generation. This vulnerability can lead to stored XSS attacks, potentially compromising users' data and session information. Websites using affected versions, from n/a to 1.1.7, should prioritize applying patches to mitigate the risk.

Affected Version(s)

WP Advanced PDF <= 1.1.7

References

https://patchstack.com/database/wordpress/plugin/wp-advan...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
JSON
.