CVE-2026-9738

Name of the Vulnerable Software and Affected Versions Print, PDF, Email by PrintFriendly for WordPress versions prior to 5.5.11

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access and above can inject arbitrary web scripts through the content position css parameter. These scripts execute whenever a user accesses an affected page.

Recommendations Update the plugin to version 5.5.11 or later. As a temporary mitigation, restrict access to the content position css parameter to minimize the risk of exploitation.