Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?e2pdfarticle2pdf
Plugin · e2pdf
e2pdf
15 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 19, 2026e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111410 · affects up to 1.32.57 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
Aug 6, 2026Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.CVE-2026-66710 · affects up to 1.32.40 · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
Jun 18, 2026E2Pdf – Export Pdf Tool for: Missing AuthorizationCVE-2026-12407 · affects up to 1.32.26 · reported by WordfenceHigh 8.8
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely — while reading an attacker-controlled option name and value from $_POST['wp_screen_options'] and passing them directly to update_option() with no allowlist, relying solely on the page-level e2pdf_templates capability which the plugin's own Permissions UI allows administrators to grant to any role including Subscriber, Contributor, Author, or Editor. This makes it possible for authenticated attackers, with a custom role that has been granted the e2pdf_templates capability, to overwrite arbitrary WordPress options such as default_role and thereby escalate their privileges to administrator.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 1, 2026e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42681 · affects up to 1.32.14 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.
May 8, 2026E2Pdf – Export Pdf Tool for: Stored Cross-Site ScriptingCVE-2026-7650 · affects up to 1.32.17 · reported by WordfenceMedium 6.4
The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `e2pdf-download` shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026e2pdf: Missing AuthorizationCVE-2026-32442 · affects up to 1.28.15 · reported by PatchstackMedium 5
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
Oct 22, 2025e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62068 · affects up to 1.28.09 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09.
Nov 1, 2024e2pdf: Missing AuthorizationCVE-2024-37415 · affects up to 1.20.27 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
Aug 18, 2024e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43318 · affects up to 1.25.05 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.25.05.
Apr 15, 2024e2pdf: Cross-Site Request Forgery (CSRF)CVE-2024-31373 · affects up to 1.20.27 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.
Dec 28, 2023E2Pdf – Export To Pdf Tool for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50849 · affects up to 1.20.23 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.
Dec 18, 2023E2Pdf – Export To Pdf Tool for: Deserialization of Untrusted DataCVE-2023-46154 · affects up to 1.20.18 · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
Dec 15, 2023E2Pdf: Arbitrary file uploadsCVE-2023-6826 · affects up to 1.20.25 · reported by WordfenceHigh 7.2
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin, to upload arbitrary files on the affected site's server which may make remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2023E2Pdf: Does not sanitize and escape some of its settingsCVE-2023-5229 · fixed in 1.20.20 · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Mar 7, 2022E2Pdf: Does not sanitise and escape some of its settingsCVE-2022-0535 · fixed in 1.16.45 · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.