CVE-2026-9738: PrintFriendly WordPress Plugin XSS Flaw

CVE-2026-9738 Overview

CVE-2026-9738 is a Stored Cross-Site Scripting (XSS) vulnerability in the Print, PDF, Email by PrintFriendly plugin for WordPress. The flaw affects all versions up to and including 5.5.10. It resides in the handling of the content_position_css parameter, which suffers from insufficient input sanitization and output escaping [CWE-79]. Authenticated attackers with administrator-level access can inject arbitrary web scripts into pages. Those scripts execute in the browsers of any user who accesses an injected page.

Critical Impact
Administrator accounts can persist arbitrary JavaScript in pages served by the plugin, enabling session theft, admin action forgery, and multi-site compromise in shared WordPress environments.

Affected Products

Print, PDF, Email by PrintFriendly plugin for WordPress — versions up to and including 5.5.10
WordPress sites with the plugin installed and active
Multisite WordPress deployments where administrator privileges are delegated

Discovery Timeline

2026-07-11 - CVE-2026-9738 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-9738

Vulnerability Analysis

The vulnerability is a Stored XSS issue tracked as [CWE-79]. The Print, PDF, Email by PrintFriendly plugin accepts the content_position_css parameter from the plugin's administrative settings interface. The plugin fails to sanitize input on write and fails to escape output on render. As a result, arbitrary HTML and JavaScript submitted through this parameter is stored in the WordPress database and later reflected verbatim into rendered pages.

When a visitor loads a page that includes the plugin's output, the injected script executes in the visitor's browser under the site's origin. This enables cookie theft, session hijacking, forced administrative actions, and drive-by delivery of secondary payloads. The affected code paths are visible in the plugin source at lines 367, 391, and 681 of pf.php in versions 5.5.8 and 5.5.10.

Root Cause

The root cause is missing input validation and missing output escaping around the content_position_css configuration value. The plugin trusts administrator-supplied CSS content and emits it directly into the HTML response. WordPress provides helpers such as wp_kses, esc_attr, and esc_html for this purpose, but they are not applied to this parameter in the vulnerable versions.

Attack Vector

Exploitation requires an authenticated account with administrator-level privileges on the target WordPress installation. The attacker navigates to the PrintFriendly plugin settings and submits a crafted payload in the content_position_css field. The payload is stored and executes for every subsequent visitor to any page rendered with the plugin. This is a persistent client-side attack that can be used to pivot laterally in delegated-admin environments, subscription sites, or managed hosting platforms where site-level admins are not fully trusted.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source for technical details.

Detection Methods for CVE-2026-9738

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes stored in the wp_options table under PrintFriendly plugin keys
HTML tags or JavaScript event handlers embedded in the content_position_css setting value
Outbound requests from visitor browsers to attacker-controlled domains sourced from pages using the PrintFriendly plugin
Administrator account modifications to plugin settings from unusual IP addresses or user agents

Detection Strategies

Audit the WordPress wp_options table for PrintFriendly-related rows containing HTML tags, <script>, or JavaScript URI schemes
Deploy a Web Application Firewall (WAF) rule to inspect POST requests to wp-admin/options.php and admin-ajax.php for script payloads in content_position_css
Review WordPress access logs for administrator activity against PrintFriendly settings endpoints correlated with anomalous session sources
Scan rendered pages containing the PrintFriendly output for inline scripts that do not match the site's expected baseline

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/printfriendly/ to detect tampering
Forward WordPress audit logs to a central SIEM and alert on changes to plugin configuration values
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages using the plugin
Track administrator logins and settings changes for correlation with subsequent XSS payload appearance

How to Mitigate CVE-2026-9738

Immediate Actions Required

Update the Print, PDF, Email by PrintFriendly plugin to a version later than 5.5.10 as soon as a patched release is available
Audit and sanitize existing content_position_css values stored in the database and remove any HTML or JavaScript content
Rotate administrator credentials and enforce multi-factor authentication on all WordPress admin accounts
Review administrator account inventory and revoke access for stale or unnecessary accounts

Patch Information

The fix is tracked in the WordPress plugin repository change set 3590593. Site operators should upgrade to the version containing this change set through the standard WordPress plugin update mechanism. Confirm the installed version reflects the patched build after applying the update.

Workarounds

Deactivate the Print, PDF, Email by PrintFriendly plugin until an updated version can be installed
Restrict administrator access to trusted operators only and limit the number of accounts with the manage_options capability
Deploy a Content Security Policy that disallows inline scripts on pages rendered by the plugin
Apply WAF filtering to strip HTML tags and JavaScript event handlers from PrintFriendly configuration POST parameters

bash

# Example: WP-CLI audit for suspicious stored payload
wp option get printfriendly | grep -Ei '<script|onerror=|onload=|javascript:'

# Deactivate the plugin as an emergency workaround
wp plugin deactivate printfriendly