{
 "id": "WPSEC-2026-1994",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1994/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1994/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1994/index.md",
 "title": "PDF Poster – Display PDF Files with Custom Viewer <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF Poster Block Document URL",
 "description": "The PDF Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the document URL of the PDF Poster block in all versions up to, and including, 2.6.1 due to insufficient validation of the URL scheme before the stored value is used as the viewer's iframe source. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the document URL to a javascript: or data: URL and inject arbitrary web scripts that execute whenever a user views the poster.",
 "plugin": {
  "slug": "pdf-poster",
  "name": "PDF Poster – Display PDF Files with Custom Viewer",
  "full_name": "PDF Poster – Let visitors read PDF’s without leaving the page",
  "wordpress_org": "https://wordpress.org/plugins/pdf-poster/",
  "advisories_url": "https://wpsec.com/vuln/plugin/pdf-poster/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/pdf-poster"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.2",
 "remediation": "Update to 2.6.2 or later.",
 "fix_released": "2026-10-29T05:17:33+00:00",
 "published": "2026-10-30T05:43:34+00:00",
 "updated": "2026-10-29T17:42:15.052238+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1994/",
  "https://plugins.svn.wordpress.org/pdf-poster/tags/2.6.2/",
  "https://wordpress.org/plugins/pdf-poster/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/pdf-poster",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}