Cross-site Scripting Vulnerability in PDF for WPForms by WordPress

CVE-2025-58620

What is CVE-2025-58620?

The PDF for WPForms plugin developed by WordPress is susceptible to a Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of a user's browser, resulting in stored XSS scenarios. Affected versions range from n/a to 6.2.1, posing a significant risk to users who utilize this plugin for generating PDFs from forms. Prompt action is advisable to mitigate potential exploitation.

References