title: E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping
description: The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: E2Pdf
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.20.20
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}