CVE-2025-8397: 
WordPress vulnerability analysis and mitigation

The Save as PDF Button plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-8397) affecting versions up to and including 1.9.2. The vulnerability was discovered and disclosed on November 13, 2025. The issue affects the plugin's restpackpdfbutton shortcode functionality and impacts WordPress installations using the vulnerable plugin versions (NVD CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's restpackpdfbutton shortcode. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page, potentially leading to theft of sensitive information or manipulation of page content (NVD CVE).

The plugin has been closed as of September 10, 2025, due to security issues. Users are advised to remove the plugin from their WordPress installations immediately as no patch is available (WordPress Plugin).