CVE-2026-42681: WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) in the WordPress e2pdf plugin (versions up to and including 1.32.14) allows an unauthenticated remote attacker to inject malicious JavaScript into pages served to victims. Exploitation requires tricking a logged-in user into clicking a crafted link, after which the script runs in the victim's browser session with access to cookies, page content, and the ability to perform actions on the victim's behalf. Successful exploitation enables limited data disclosure, content tampering, and minor service disruption within the victim's browser context. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target WordPress site over the network to deliver a crafted URL containing the malicious payload.

• AuthenticationNot required

  No account or credentials are needed; the attacker crafts a link and delivers it to a victim without authenticating to the application.

• Victim interactionRequired

  A victim (typically a logged-in WordPress user) must click the attacker-supplied link for the reflected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• Reads browser-accessible session cookies and authentication tokens belonging to the victim, enabling session hijacking.
• Reads page content visible to the victim, which may include sensitive WordPress admin data or user-submitted information.
• Modifies the page as rendered in the victim's browser, allowing the attacker to inject fake forms or redirect the victim to other sites.
• Triggers authenticated WordPress actions on behalf of the victim, such as creating or deleting content, within the victim's permission level.