Hey tori—
I hear your frustration with this. However, the XSS filter can be triggered by PDF’s for numerous legitimate reasons, and the only way to ensure a PDF can be uploaded every time is to disable the filter for now. Like Brandon said, future versions of EE will include a configuration variable that lets you exempt certain groups from the filter. For now, if you’re running a site that allows members of the public to upload photos or avatars to their profiles, you may want to disable those features if you do not have the XSS filter enabled.
Kevin