Security experts warned Wednesday of a vulnerability in Adobe Acrobat Reader plug-in that makes PDF-friendly websites susceptible to cross-site scripting (XSS) attacks, worms, and theft of cookies and session information.