CVE-2026-4073

OVERVIEW CVE-2026-4073 is a Stored Cross-Site Scripting (XSS) vulnerability in the pdfl.io WordPress plugin affecting all versions through 1.0.5. The flaw stems from insufficient input sanitization in the 'pdflio' shortcode's 'text' attribute, where the output_shortcode() function fails to apply proper HTML escaping functions when rendering user-supplied content. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privileges. Exploitation requires authenticated access at the Contributor level or above, and while it does not demand user interaction, the impact is limited to low-level confidentiality and integrity compromise. The attack scope is changed, meaning impact extends beyond the vulnerable component itself. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat intelligence hot lists. The EPSS score of 0.0004 reflects minimal real-world exploitation probability. However, the underlying flaw is straightforward to exploit for authenticated users, and remediation should be prioritized for internet-facing WordPress installations with untrusted contributor accounts.