Vulnerabilities / PDF Poster – Display PDF Files with Custom Viewer / WPSEC-2026-1994
PDF Poster – Display PDF Files with Custom Viewer <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF Poster Block Document URL
Medium 6.4
CWE-79Fixed in 2.6.2
- ID
- WPSEC-2026-1994
- Plugin
- PDF Poster – Let visitors read PDF’s without leaving the page (pdf-poster)
- Affected
- all versions before 2.6.2
- Remediation
- Update to 2.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- PDF Poster – Display PDF Files with Custom Viewer on WPSec AttackSurface
- Fix released
- Published
Description
The PDF Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the document URL of the PDF Poster block in all versions up to, and including, 2.6.1 due to insufficient validation of the URL scheme before the stored value is used as the viewer's iframe source. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the document URL to a javascript: or data: URL and inject arbitrary web scripts that execute whenever a user views the poster.
References
- https://wpsec.com/vuln/WPSEC-2026-1994/
- https://plugins.svn.wordpress.org/pdf-poster/tags/2.6.2/
- https://wordpress.org/plugins/pdf-poster/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS