{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4073", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-12T19:50:33.445Z", "datePublished": "2026-04-08T09:25:48.500Z", "dateUpdated": "2026-04-08T16:43:47.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:47.056Z"}, "affected": [{"vendor": "dougblackjr", "product": "pdfl.io", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is due to insufficient input sanitization and output escaping on the 'text' shortcode attribute. The output_shortcode() function directly concatenates the user-supplied $text variable into HTML output without applying esc_html() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf70203-61c0-406a-9110-b60761b4a513?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L117"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L117"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L81"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L81"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492458%40pdfl-io&new=3492458%40pdfl-io"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2026-03-27T08:24:36.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T20:58:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T16:01:20.148429Z", "id": "CVE-2026-4073", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:01:27.020Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T16:01:20.148429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:01:23.658Z"}}], "cna": {"title": "pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "dougblackjr", "product": "pdfl.io", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-27T08:24:36.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T20:58:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf70203-61c0-406a-9110-b60761b4a513?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L117"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L117"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L81"}, {"url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L81"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492458%40pdfl-io&new=3492458%40pdfl-io"}], "descriptions": [{"lang": "en", "value": "The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is due to insufficient input sanitization and output escaping on the 'text' shortcode attribute. The output_shortcode() function directly concatenates the user-supplied $text variable into HTML output without applying esc_html() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T09:25:48.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4073", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:01:27.020Z", "dateReserved": "2026-03-12T19:50:33.445Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T09:25:48.500Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is due to insufficient input sanitization and output escaping on the 'text' shortcode attribute. The output_shortcode() function directly concatenates the user-supplied $text variable into HTML output without applying esc_html() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-4073", "lastModified": "2026-04-08T21:26:13.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-08T10:16:01.777", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L117"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pdfl-io/tags/1.0.5/pdflio.php#L81"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L117"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pdfl-io/trunk/pdflio.php#L81"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492458%40pdfl-io&new=3492458%40pdfl-io"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf70203-61c0-406a-9110-b60761b4a513?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pdfl.io", "source": "cna", "vendor": "dougblackjr"}, "product": "pdfl.io", "vendor": "dougblackjr"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:21:08.949622+00:00", "value": {"mitigation_remediation": ["Update the pdfl.io plugin to the latest release that removes the XSS vulnerability. ", "If an update is not immediately possible, disable or delete the plugin to stop the risk of script injection. ", "Revoke Contributor\u2011level access from users who do not need it, and apply the least privilege principle for WordPress roles. ", "Deploy web\u2011application security monitoring or a WAF that blocks unexpected scripts and review logs for suspicious shortcode usage."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the pdfl.io WordPress plugin developed by Doug Black Jr. All releases up to and including version 1.0.5 are impacted. WordPress sites that have installed any of these versions and have users with Contributor or higher roles are susceptible.", "description_and_impact": "The pdfl.io plugin for WordPress is vulnerable to stored cross\u2011site scripting caused by insufficient sanitization of the 'text' attribute in the 'pdflio' shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary HTML and JavaScript, leading to malicious script execution when any visitor loads a page that contains the compromised shortcode. This can be used to steal session cookies, deface content, or redirect users to phishing sites. The flaw resides in the output_shortcode() function, which concatenates the user\u2011supplied $text variable without employing escaping functions such as esc_html(), aligning with CWE\u201179 for unvalidated input.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitability is limited to authenticated users with Contributor or higher privileges, which means a site with weak role assignment or compromised account can be used as an attack surface. An attacker can inject persistent scripts into content that will run in the browsers of all visitors, enabling credential theft or site defacement. While the direct vector requires authentication, the damage can affect all site users once the malicious content is served."}}}}, "created": "2026-04-08T19:27:19.278226+00:00", "updated": "2026-04-08T19:39:57.379753+00:00", "vendors": ["dougblackjr", "dougblackjr$PRODUCT$pdfl.io", "wordpress", "wordpress$PRODUCT$wordpress"]}