CVE-2026-7650 Overview
CVE-2026-7650 is a Stored Cross-Site Scripting (XSS) vulnerability in the E2Pdf – Export Pdf Tool for WordPress plugin. The flaw affects all plugin versions up to and including 1.32.17. It resides in the id attribute of the e2pdf-download shortcode, where input sanitization and output escaping are insufficient. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page, enabling session theft, redirection, and content manipulation. The issue is classified under CWE-79.
Critical Impact
Authenticated contributors can persist JavaScript that executes against site visitors and administrators, enabling session hijacking and account takeover paths.
Affected Products
- E2Pdf – Export Pdf Tool for WordPress plugin versions <= 1.32.17
- WordPress sites permitting Contributor-level or higher accounts
- Fixed in version 1.32.18
Discovery Timeline
- 2026-05-08 - CVE-2026-7650 published to NVD
- 2026-05-08 - Last updated in NVD database
Technical Details for CVE-2026-7650
Vulnerability Analysis
The vulnerability exists in the shortcode handler defined in classes/model/e2pdf-shortcode.php. The plugin processes the id attribute supplied to the [e2pdf-download] shortcode without applying sufficient sanitization on input or escaping on output. When a contributor authors a post containing a crafted shortcode invocation, the attacker-controlled attribute value is rendered into the page markup. Browsers then parse and execute the injected payload in the context of the affected site origin.
Because the payload is stored in post content, it persists across page loads and executes for every visitor who renders the page. The scope change to a different security authority is reflected in the CVSS vector, since script executes in the visitor's browser context rather than only the attacker's session.
Root Cause
The root cause is missing or inadequate sanitization of the id shortcode attribute prior to inclusion in HTML output. The vulnerable code path is visible in the pre-patch source at line 157, and the fix at version 1.32.18 line 172 adds proper escaping. The patch commit is recorded in the WordPress plugin changeset 3522046.
Attack Vector
An attacker authenticates as a Contributor or higher and creates or edits a post containing the e2pdf-download shortcode with a malicious payload embedded in the id attribute. When an administrator or site visitor previews or views the post, the script executes. Refer to the Wordfence Vulnerability Report for additional disclosure details.
No verified exploit code is published. The vulnerability is described in prose;
see the WordPress code references for the vulnerable and patched implementations.
Detection Methods for CVE-2026-7650
Indicators of Compromise
- Posts or pages containing [e2pdf-download] shortcode invocations where the id attribute contains HTML tags, quotes, or JavaScript keywords such as onerror, onload, or <script>.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after viewing posts that include the shortcode.
- New or modified posts authored by Contributor-level accounts that include shortcode parameters with non-numeric id values.
Detection Strategies
- Query the WordPress wp_posts table for post_content matching the regular expression \[e2pdf-download[^\]]*id=["'][^"']*[<>"][^"']*["'] to surface suspicious shortcode usage.
- Review web server logs for HTTP responses from pages containing the shortcode that include <script> tags or event handler attributes not present in the original template.
- Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages rendered by the plugin.
Monitoring Recommendations
- Audit accounts holding Contributor and Author roles, and alert on post creation events that include e2pdf-download shortcodes.
- Enable WordPress activity logging to capture post_updated and post_published events with content diffs for forensic review.
- Correlate authenticated session activity with subsequent administrator account changes such as password resets or role escalations.
How to Mitigate CVE-2026-7650
Immediate Actions Required
- Update the E2Pdf – Export Pdf Tool for WordPress plugin to version 1.32.18 or later immediately.
- Audit all existing posts and pages for malicious e2pdf-download shortcode payloads and sanitize affected content.
- Review Contributor, Author, and Editor accounts for unauthorized access, and rotate credentials where compromise is suspected.
Patch Information
The vendor released the fix in version 1.32.18. The corrective change is recorded in the WordPress plugin changeset 3522046 and applies proper escaping to the shortcode attribute handler in classes/model/e2pdf-shortcode.php. The current plugin distribution is available from the WordPress Plugin Directory.
Workarounds
- Restrict Contributor-level account provisioning until the plugin is updated, limiting who can author posts containing shortcodes.
- Deploy a web application firewall (WAF) rule that blocks HTTP responses containing e2pdf-download shortcode rendering with embedded <script> or event handler attributes.
- Implement a strict Content Security Policy that disallows inline script execution to reduce the impact of stored payloads.
# Update the plugin via WP-CLI
wp plugin update e2pdf --version=1.32.18
# Verify installed version
wp plugin get e2pdf --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
