Extension WordPress
Vulnérabilités E2Pdf – Export Pdf Tool for WordPress
Cette page rassemble les failles publiées pour E2Pdf – Export Pdf Tool for WordPress, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de E2Pdf – Export Pdf Tool for WordPress
13 fiches
E2Pdf <= 1.32.26 – Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification…
*-1.32.26
1.32.31
17/06/2026
E2Pdf – Export Pdf Tool for WordPress <= 1.32.14 – Reflected Cross-Site Scripting
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.32.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-1.32.14
1.32.15
18/05/2026
E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `e2pdf-download` shortcode in all versions up to, and including, 1.32.17. This is due to insufficient…
*-1.32.17
1.32.18
07/05/2026
e2pdf <= 1.28.15 – Missing Authorization
The e2pdf plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.28.15. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-1.28.15
1.32.00
04/03/2026
e2pdf <= 1.28.09 – Authenticated (Contributor+) Stored Cross-Site Scripting
The e2pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.28.09 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-1.28.09
1.28.10
16/10/2025
e2pdf <= 1.25.05 – Authenticated (Contributor+) Stored Cross-Site Scripting
The e2pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.25.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,…
*-1.25.05
1.25.11
16/08/2024
E2Pdf – Export To Pdf Tool for WordPress <= 1.20.27 – Missing Authorization
The E2Pdf – Export To Pdf Tool for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.20.27. This makes it possible…
*-1.20.27
1.23.00
28/06/2024
e2pdf <= 1.20.27 – Cross-Site Request Forgery
The e2pdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.20.27. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to…
*-1.20.27
1.23.00
10/04/2024
E2Pdf <= 1.20.23 – Authenticated(Administrator+) SQL Injection
The E2Pdf – Export To Pdf Tool for WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.20.24 (exclusive) due to insufficient escaping on the user supplied parameter and…
[*, 1.20.24)
1.20.24
21/12/2023
E2Pdf <= 1.20.25 – Authenticated (Administrator+) Arbitrary File Upload
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role…
*-1.20.25
1.20.26
13/12/2023
E2Pdf <= 1.20.18 – Authenticated (Administrator+) PHP Object Injection
The E2Pdf plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.20.18 via deserialization of untrusted input within the import_action and ajax_upload functions. This makes it possible for authenticated attackers, with…
*-1.20.18
1.20.19
17/10/2023
e2pdf < 1.20.20 – Authenticated (Administrator+) Stored Cross-Site Scripting
The E2Pdf – Export To Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 1.20.20 (exclusive) due to insufficient input sanitization and output escaping. This makes…
[*, 1.20.20)
1.20.20
09/10/2023
E2Pdf <= 1.16.44 – Stored Cross-Site Scripting
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
*-1.16.44
1.16.45
09/02/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.