CVE-2026-48195: WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

PDF Poster installations running versions through 2.6.1 are affected. The available information does not identify a lower version boundary.

Q: What access does an attacker need?

The CVSS vector indicates the attacker needs network access and low-level privileges. Exploitation also requires user interaction and has low attack complexity.

Q: What could successful exploitation allow?

This is a stored XSS issue. The reported impact includes low-level effects on confidentiality, integrity, and availability, with scope changed.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress PDF Poster to a version that resolves this vulnerability.
Fixed in 2.6.2

Event History

Oct 29, 2026

CVE Published

via MITRE·01:07 PM

Data Sourced

via MITRE·01:07 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

PDF Poster installations running versions through 2.6.1 are affected. The available information does not identify a lower version boundary.

What access does an attacker need?

The CVSS vector indicates the attacker needs network access and low-level privileges. Exploitation also requires user interaction and has low attack complexity.

What could successful exploitation allow?

This is a stored XSS issue. The reported impact includes low-level effects on confidentiality, integrity, and availability, with scope changed.

CVE-2026-48195: WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need?

What could successful exploitation allow?