WordPress Plugin Vulnerabilities

PDF Generator for WordPress < 1.1.2 - Reflected XSS

Description

The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin

Proof of Concept

Affects Plugins

Plugin icon
pdf-generator-for-wp
Fixed in 1.1.2

References

CVE
CVE-2022-4321

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.5 (high)

Miscellaneous

Original Researcher
cydave
Submitter
cydave
Submitter website
https://cyllective.com/
Submitter twitter
cyllective
Verified
Yes
WPVDB ID
6ac1259c-86d9-428b-ba98-7f3d07910644

Timeline

Publicly Published
2023-01-16 (about 3 years ago)
Added
2023-01-16 (about 3 years ago)
Last Updated
2023-01-16 (about 3 years ago)

Other

Published
Title
Published
2014-04-28
Title
Keyword Strategy Internal Links <= 2.0 - XSS
Published
2024-11-19
Title
Booster for WooCommerce < 7.2.4 - Reflected Cross-Site Scripting
Published
2024-03-25
Title
WP Post Disclaimer < 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-25
Title
Co-marquage service-public.fr < 0.5.73 - Reflected Cross-Site Scripting via search_term
Published
2025-12-07
Title
Ultimate Review <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting