CVE-2025-39427: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in the WP Post to PDF Enhanced WordPress plugin, affecting versions up to 1.1.1. The vulnerability was identified on April 17, 2025, and assigned identifier CVE-2025-39427. This security issue affects the Beth Tucker Long WP Post to PDF Enhanced plugin, allowing attackers to perform stored XSS attacks (Patchstack, NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 Base Score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires high privileges to exploit and user interaction is necessary for successful exploitation (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. Given the low severity impact, virtual patching has been deemed unnecessary (Patchstack).