PT-2026-47671 · WordPress · Epaperflip Publisher

Zakaria · CVE-2026-7662 · Published 2026-06-09 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ePaperFlip Publisher versions prior to 1.1

Description The ePaperFlip Publisher plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the publicationid attribute of the epaperflip embed shortcode lacks sufficient input sanitization and output escaping, allowing the attribute to be injected directly into inline JavaScript. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update to a version later than 1. As a temporary workaround, restrict the use of the publicationid attribute within the epaperflip embed shortcode for users with Contributor-level access.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7662

Affected Products

Epaperflip Publisher

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-7662 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/93be1150-4c83-4fa3-8dc6-71e2f1ddaa66?source=cve · Note
• https://twitter.com/atomicedgeWAF/status/2065030375869403154 · Twitter Post
• https://wordpress.org/plugins/epaperflip-publisher · Note
• https://plugins.trac.wordpress.org/browser/epaperflip-publisher/trunk/ePaperFlip%20Publisher.php#L28 · Note
• https://t.me/CVEtracker/56248 · Telegram Post