CVE-2026-7650

Name of the Vulnerable Software and Affected Versions E2Pdf – Export Pdf Tool for WordPress versions prior to 1.32.18

Description The E2Pdf – Export Pdf Tool for WordPress plugin allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts. This occurs due to insufficient input sanitization and output escaping within the id attribute of the e2pdf-download shortcode. These scripts execute whenever a user accesses a page where the malicious code was injected.

Recommendations Update the plugin to a version later than 1.32.17. As a temporary workaround, restrict the use of the id attribute in the e2pdf-download shortcode for users with Contributor-level access.