The vulnerability CVE-2025-39427 affects the WP Post to PDF Enhanced WordPress plugin, allowing stored cross-site scripting due to improper input neutralization during web page generation. This enables an attacker with high privileges to inject malicious scripts that can execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, required privileges at high level, and user interaction required. The scope is changed, indicating impact beyond the vulnerable component.

Successful exploitation can lead to limited disclosure of information, modification of data, and disruption of availability within the affected WordPress environment. The attacker must have high privileges and user interaction is required, which limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege user access and avoid interacting with untrusted content in the plugin. Monitor vendor channels for updates and apply patches promptly once available.