CVE-2026-4073 is a stored cross-site scripting vulnerability in the pdfl.io WordPress plugin caused by improper neutralization of input during web page generation (CWE-79). The output_shortcode() function concatenates user-supplied input from the 'text' shortcode attribute directly into HTML output without applying escaping functions such as esc_html(). This flaw allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of any user viewing the compromised page. The vulnerability affects all versions up to and including 1.0.5.

Successful exploitation allows an attacker with Contributor-level access to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the pdfl.io plugin to prevent exploitation. Monitor for updates from the vendor regarding patches or official mitigations.