Executive brief
The pdfl.io plugin for WordPress, which provides PDF-related functionality, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into website pages. These scripts execute automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. This could compromise the integrity of the website and the security of its visitors.
Technical details
The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'text' attribute of the 'pdflio' shortcode. Specifically, the output_shortcode() function directly concatenates the user-supplied $text variable into the HTML output without utilizing WordPress escaping functions like esc_html(). This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts are stored on the server and execute in the browser of any user who visits the compromised page. The vulnerability is present in all versions up to and including 1.0.5.
Affected products
- dougblackjr pdfl.io <= 1.0.5
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php
- https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php
- https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php
- https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492458%40pdfl-io&new=3492458%40pdfl-io
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf70203-61c0-406a-9110-b60761b4a513?source=cve