CVE-2026-0862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0862", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-12T14:46:34.760Z", "datePublished": "2026-01-24T15:34:06.548Z", "dateUpdated": "2026-04-08T17:01:05.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:05.994Z"}, "affected": [{"vendor": "pdfcrowd", "product": "Save as PDF Plugin by PDFCrowd", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018options\u2019 parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: Successful exploitation of this vulnerability requires that the PDFCrowd API key is blank (also known as \"demo mode\", which is the default configuration when the plugin is installed) or known."}], "title": "Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74172fcb-7428-464a-89f1-f1f3af50e361?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438577/save-as-pdf-by-pdfcrowd"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "timeline": [{"time": "2026-01-24T02:47:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T15:28:56.392771Z", "id": "CVE-2026-0862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:38:22.497Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0862", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-12T14:46:34.760Z", "datePublished": "2026-01-24T15:34:06.548Z", "dateUpdated": "2026-01-26T15:38:22.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-24T15:34:06.548Z"}, "affected": [{"vendor": "pdfcrowd", "product": "Save as PDF Plugin by PDFCrowd", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "4.5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018options\u2019 parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: Successful exploitation of this vulnerability requires that the PDFCrowd API key is blank (also known as \"demo mode\", which is the default configuration when the plugin is installed) or known."}], "title": "Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74172fcb-7428-464a-89f1-f1f3af50e361?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3438577/save-as-pdf-by-pdfcrowd"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "timeline": [{"time": "2026-01-24T02:47:36.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T15:28:56.392771Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:29:23.881Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Save as PDF Plugin by PDFCrowd", "vendor": "pdfcrowd", "versions": [{"lessThanOrEqual": "4.5.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018options\u2019 parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: Successful exploitation of this vulnerability requires that the PDFCrowd API key is blank (also known as \"demo mode\", which is the default configuration when the plugin is installed) or known."}, {"lang": "es", "value": "El plugin Save as PDF Plugin por PDFCrowd para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'options' en todas las versiones hasta la 4.5.5, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace. NOTA: La explotaci\u00f3n exitosa de esta vulnerabilidad requiere que la clave API de PDFCrowd est\u00e9 en blanco (tambi\u00e9n conocido como \"modo de demostraci\u00f3n\", que es la configuraci\u00f3n predeterminada cuando se instala el plugin) o sea conocida."}], "id": "CVE-2026-0862", "lastModified": "2026-06-17T10:11:31.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0862", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T15:28:56.392771Z", "version": "2.0.3"}}]}, "published": "2026-01-24T16:15:52.697", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3438577/save-as-pdf-by-pdfcrowd"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74172fcb-7428-464a-89f1-f1f3af50e361?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:36:23.670046+00:00", "value": {"mitigation_remediation": ["Update the Save as PDF Plugin by PDFCrowd to a version newer than 4.5.5 where the issue is fixed.", "Configure the plugin with a valid API key to disable demo mode, which eliminates the vulnerability\u2019s prerequisite.", "Restrict the plugin\u2019s usage to authenticated administrators or apply server\u2011side validation to sanitize the options parameter, reducing any remaining risk."], "summary": {"action": "Apply patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress installations that use the Save as PDF Plugin by PDFCrowd and have a version of 4.5.5 or earlier are affected. The vulnerability exists in every release up to and including version 4.5.5, regardless of the WordPress core version.", "description_and_impact": "The Save as PDF Plugin by PDFCrowd is vulnerable to reflected cross\u2011site scripting through the unsanitized options parameter. An attacker can embed malicious JavaScript in a crafted URL; if a user follows that link while the plugin is in demo mode (or the attacker knows the API key), the script executes in the victim\u2019s browser. This allows an unauthenticated attacker to run arbitrary code within the context of the site\u2019s web page.", "risk_and_exploitability": "The CVSS score of 6.1 reflects moderate severity, while the EPSS score of less than 1\u202f% indicates a low likelihood of exploitation at this time. The vulnerability is not included in CISA\u2019s KEV catalog. Successful exploitation requires that the plugin be operating in demo mode (blank API key) or that the attacker already knows the API key, and it requires user interaction to trigger the malicious script."}}}}, "created": "2026-01-26T11:48:11.201388+00:00", "updated": "2026-04-15T21:45:14.144856+00:00", "vendors": ["pdfcrowd", "pdfcrowd$PRODUCT$save_as_pdf", "pdfcrowd$PRODUCT$save_as_pdf_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}