Reflected XSS Vulnerability in E2Pdf by E2Pdf.Com
CVE-2026-42681

7.1HIGH

Key Information:

Vendor

WordPress
Status
E2PDF
Vendor
CVE Published:
1 June 2026

What is CVE-2026-42681?

A reflected Cross-site Scripting (XSS) vulnerability exists in E2Pdf, a product by E2Pdf.Com, which allows for unauthorized execution of scripts within a user's browser. This issue is triggered through improper sanitization of input during web page generation, potentially leading to data theft or account compromise. The vulnerability affects E2Pdf versions up to and including 1.32.14. It is crucial for users to apply the necessary updates to mitigate the associated risks.

Affected Version(s)

e2pdf <= 1.32.14

References

https://patchstack.com/database/wordpress/plugin/e2pdf/vu...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hhhai | Patchstack Bug Bounty Program
.