CVE-2025-28911: Gravity 2 PDF XSS Vulnerability

CVE-2025-28911 Overview

CVE-2025-28911 is a reflected cross-site scripting (XSS) vulnerability in the Gravity 2 PDF WordPress plugin (gf2pdf) developed by gravity2pdf. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all versions of Gravity 2 PDF up to and including 3.1.3. An attacker can craft a malicious URL containing JavaScript payloads that execute in the victim's browser when the link is clicked. Successful exploitation enables session theft, credential harvesting, and arbitrary actions performed in the context of the authenticated user.

Critical Impact
Reflected XSS in the Gravity 2 PDF plugin allows attackers to execute arbitrary JavaScript in a victim's browser session, potentially compromising WordPress administrator accounts.

Affected Products

Gravity 2 PDF (gf2pdf) WordPress plugin versions up to and including 3.1.3
WordPress installations with the vulnerable plugin enabled
Sites where administrators or privileged users can be tricked into clicking crafted links

Discovery Timeline

2025-03-26 - CVE-2025-28911 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28911

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Gravity 2 PDF plugin for WordPress. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back into HTML responses. Attackers craft URLs containing JavaScript payloads in vulnerable parameters and deliver them to authenticated WordPress users through phishing or social engineering. When the victim loads the malicious URL, the injected script executes in the browser under the origin of the WordPress site.

The scope-changed CVSS vector indicates the attack can affect resources beyond the vulnerable component, including the broader WordPress administration context. User interaction is required, but no privileges or authentication on the attacker side are needed.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Request parameters processed by the plugin are inserted into rendered HTML without adequate output encoding or input validation, enabling script injection through user-controlled values.

Attack Vector

The attack vector is network-based through a crafted URL. The attacker delivers a malicious link to a target user, typically a WordPress administrator or editor. When the victim clicks the link, the plugin reflects the attacker-controlled payload into the response, and the browser executes the injected JavaScript. The script can read session cookies, perform actions on behalf of the user, or pivot to administrative functions. See the Patchstack Gravity PDF Plugin Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-28911

Indicators of Compromise

Web server access logs showing requests to Gravity 2 PDF plugin endpoints containing URL-encoded <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after a user clicked an external link
Unauthorized WordPress administrative actions correlating with reflected payloads in HTTP referer headers

Detection Strategies

Inspect HTTP request parameters reaching gf2pdf plugin paths for script tags, encoded payloads, and common XSS vectors
Deploy a web application firewall (WAF) ruleset that flags reflected XSS patterns against WordPress plugin URLs
Correlate suspicious referer headers with subsequent privileged actions in WordPress audit logs

Monitoring Recommendations

Enable verbose WordPress audit logging for plugin-related requests and administrative actions
Monitor browser-side Content Security Policy (CSP) violation reports for blocked inline script execution
Alert on anomalous administrator session activity such as new user creation or plugin installs following external link clicks

How to Mitigate CVE-2025-28911

Immediate Actions Required

Update the Gravity 2 PDF (gf2pdf) plugin to a version newer than 3.1.3 once a patched release is available from the vendor
Disable or remove the plugin on sites that do not require its functionality until a fix is applied
Educate WordPress administrators and editors about phishing links targeting plugin endpoints

Patch Information

The vulnerability affects Gravity 2 PDF versions up to and including 3.1.3. Refer to the Patchstack Gravity PDF Plugin Vulnerability entry for the latest patch status and remediation guidance from the maintainer.

Workarounds

Deploy a WAF rule blocking requests to Gravity 2 PDF plugin endpoints that contain XSS payload patterns
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to WordPress administrative interfaces by IP allowlist or VPN to reduce phishing exposure

bash

# Example nginx rule to block obvious XSS payloads on gf2pdf endpoints
location ~* /wp-content/plugins/gf2pdf/ {
    if ($args ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
}