Skip to content
Noroxi

E2Pdf – Export Pdf Tool for WordPress

e2pdf · plugin

Known security vulnerabilities for E2Pdf – Export Pdf Tool for WordPress. Find out in seconds which version runs on your site with WP Lens.

13 known vulnerabilities

4 exploitable without logging in · 1 with public exploit code · latest Aug 6, 2026

Listed on wordpress.org · latest 1.32.53 · last updated Sep 28, 2026 · 10K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2026-12407login required≤ 1.32.26

    E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter

    High 8.8

  • CVE-2026-66710unauthenticated≤ 1.32.40

    WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability

    High 8.1

  • CVE-2023-50849high privilege≤ 1.20.23

    WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection

    High 7.2

  • CVE-2023-46154high privilege≤ 1.20.18

    WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

    High 7.2

  • CVE-2023-6826admin≤ 1.20.25

    E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload

    High 7.2

  • CVE-2026-42681unauthenticated · needs a click≤ 1.32.14

    WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-62068login required≤ 1.28.09

    WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-7650contributor+≤ 1.32.17

    E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

    Medium 6.4

  • CVE-2024-37415unauthenticated · needs a click≤ 1.20.27

    WordPress E2Pdf plugin <= 1.20.27 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2024-31373unauthenticated · needs a click≤ 1.20.27

    WordPress E2Pdf plugin <= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 5.4

  • CVE-2024-43318login required≤ 1.25.05

    WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2026-32442login required≤ 1.28.15

    WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability

    Medium 5.0

  • CVE-2022-0535admin→ 1.16.45

    E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory