CVE-2026-4073 pdfl.io CVE debrief

Who should care

Users of the pdfl.io plugin for WordPress, particularly those with Contributor-level access and above, should be aware of this vulnerability. Affected operators include WordPress site administrators and users with sufficient privileges to inject content via the 'pdflio' shortcode. Vulnerability management and security teams should review and prioritize patching of affected deployments. Platform impact may include web application security and integrity.

Technical summary

The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is due to insufficient input sanitization and output escaping on the 'text' shortcode attribute. The output_shortcode() function directly concatenates the user-supplied $text variable into HTML output without applying esc_html() or any other escaping function. Affected product context includes WordPress sites using the pdfl.io plugin. Defensive impact includes the potential for authenticated attackers to inject arbitrary web scripts.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject arbitrary web scripts.

Recommended defensive actions

• Update the pdfl.io plugin to a version beyond 1.0.5
• Implement additional input validation and output escaping for the 'pdflio' shortcode
• Monitor for suspicious activity related to the 'pdflio' shortcode
• Restrict access to the 'pdflio' shortcode to prevent unauthorized modifications
• Regularly review and update the plugin to ensure the latest security patches are applied
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T10:16:01.777Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability was reported by [email protected]. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected deployments and review official advisories for further details.

Official resources