Stored Cross-Site Scripting in pdfl.io Plugin for WordPress

CVE-2026-4073

What is CVE-2026-4073?

The pdfl.io plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping processes within the 'pdflio' shortcode. Specifically, the output_shortcode() function allows user-supplied text to be directly embedded into HTML output without proper escaping methods such as esc_html(). This flaw grants authenticated attackers, possessing Contributor-level access or higher, the ability to inject malicious web scripts into pages. The scripts will execute when users visit the affected pages, potentially compromising user data and site security.

References