CVE-2024-33684 MEDIUM

CVE-2024-33684: WordPress Save as PDF plugin by Pdfcrowd plugin <= 3.2.0 - Broken Access Control to Stored XSS vulnerability

Vendor Pdfcrowd
Product Save as PDF plugin by Pdfcrowd
Weakness CWE-862 · Missing authorization
Published April 29, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.0.

Explanation of Vulnerability in Simple Terms

02Summary

The Save as PDF plugin by Pdfcrowd through version 3.2.0 fails to properly check user permissions before allowing PDF generation and download actions. A logged-in user with low privileges can generate PDFs of content they shouldn't access and potentially modify site data. The vulnerability requires user interaction and affects the site's confidentiality, integrity, and availability.

What an attacker can do

03Attacker Capabilities

A logged-in user can generate and download PDFs of restricted content and potentially modify site data.

Potential impact on your site

04Site Impact

Unauthorized users may access sensitive content as PDFs and alter site data; requires immediate plugin update.

Conditions required to exploit

05Prerequisites

Attacker must be logged in with low-level user account; victim must click a malicious link or visit a crafted page.

Key dates

06Disclosure timeline

April 29, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-59547 WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability CVE-2026-65472 WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability CVE-2026-27422 WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability CVE-2026-65495 WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability CVE-2026-57717 WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability