WordPress E2Pdf <1.16.45 - Cross-Site Scripting

WordPress E2Pdf plugin before 1.16.45 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, even when the unfilteredhtml capability is disallowed. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context o...

The WordPress E2Pdf file contains a vulnerability

WordPress E2Pdf is a plugin designed specifically for WordPress. Its core functionality involves creating and editing PDF documents and forms directly from the site backend. It also supports automatically converting post, page, or form content into dynamic/static PDF outputs. WordPress E2Pdf has ...

CVE-2026-66710

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-66710

Technical details are not publicly available in the provided documents. The CVE-2026-66710 entry states an Unauthenticated Local File Inclusion in WordPress e2pdf plugin

CVE-2026-66710 WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-66710

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

EUVD-2026-53913

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

CVE-2026-66710: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...

PT-2026-68603

Name of the Vulnerable Software and Affected Versions e2pdf versions prior to 1.32.41 Description An unauthenticated Local File Inclusion LFI issue exists in the e2pdf plugin. Local File Inclusion is a vulnerability that allows an attacker to read files on the server that are not intended to be...

WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Noman Riffat in WordPress Plugin e2pdf versions = 1.32.40...

CVE-2026-12407

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2026-12407 E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2026-12407

CVE-2026-12407 affects the E2Pdf – Export Pdf Tool for WordPress plugin versions up to 1.32.26. The screen_action() path bypasses nonce and capability checks, reading attacker-controlled options from $_POST['wp_screen_options'] and passing them to update_option() with no allowlist, enabling authe...

EUVD-2026-37836

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2026-12407 E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2026-12407

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

CVE-2026-12407: Missing Authorization

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

WordPress E2Pdf – Export Pdf Tool for WordPress plugin <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Option Update / Privilege Escalation vulnerability discovered by endy in WordPress Plugin e2pdf versions = 1.32.26...

CVE-2026-7650

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode...