There are so many different ways of executing script. Just stripping out script tags isn't really enough. Here's another example which I've just tested with you

There are so many different ways of executing script. Just stripping out script tags isn't really enough. Here's another example which I've just tested with your service and works: <img src="#" onerror="alert('XSS')"> It's also possible to use SVG images with embedded javascript. You could generate a PNG from the PDF and display that inline in the page. You could then have a "(PDF Version with Clickable links)" link next to it?