# PDF Poster – Display PDF Files with Custom Viewer <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF Poster Block Document URL

- **ID:** WPSEC-2026-1994
- **Plugin:** PDF Poster – Let visitors read PDF’s without leaving the page (`pdf-poster`), https://wordpress.org/plugins/pdf-poster/
- **Affected versions:** all versions before 2.6.2
- **Fixed in:** 2.6.2 (Update to 2.6.2 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pdf-poster
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1994/

## Description

The PDF Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the document URL of the PDF Poster block in all versions up to, and including, 2.6.1 due to insufficient validation of the URL scheme before the stored value is used as the viewer's iframe source. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the document URL to a javascript: or data: URL and inject arbitrary web scripts that execute whenever a user views the poster.

## References

- https://wpsec.com/vuln/WPSEC-2026-1994/
- https://plugins.svn.wordpress.org/pdf-poster/tags/2.6.2/
- https://wordpress.org/plugins/pdf-poster/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1994/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.