CVE-2026-9738 is a stored cross-site scripting vulnerability in the Print, PDF & Email by PrintFriendly WordPress plugin affecting all versions up to 5.5.10. The issue is due to improper neutralization of input in the 'content_position_css' parameter, allowing authenticated administrators or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability requires high privileges (administrator or above) and does not require user interaction beyond accessing the injected page.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not affect availability. The attack complexity is high due to the need for administrator privileges, and no user interaction is required beyond viewing the page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid using the vulnerable parameter or disable the plugin if possible. Follow vendor updates for an official fix.