Stirling-PDF is vulnerable to a cross-site scripting attack, which could allow an unauthenticated attacker to compromise user sessions and perform unauthorized actions within the application.

The application fails to properly neutralize input during web page generation, leading to a cross-site scripting (XSS) vulnerability. An attacker can leverage this flaw without authentication by convincing a user to interact with a malicious link or crafted input.

The CVSS score of 8.1 indicates a high risk to the confidentiality and integrity of the application. Exploitation could result in session hijacking, unauthorized access to sensitive PDF documents processed by the tool, or the execution of malicious actions on behalf of authenticated users.

Immediate Action: Upgrade to Stirling-PDF version 2.0.0 or later to resolve the underlying input neutralization flaw.

Proactive Monitoring: Review web application logs for suspicious script injection patterns or unusual redirection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to block malicious input vectors until the update can be applied.

Public Exploit Available: Unknown

Due to the nature of cross-site scripting and the high CVSS score, immediate patching is required to protect users. Organizations should update to version 2.0.0 immediately and encourage users to avoid clicking suspicious links while using the application.