Embed Any Document CVE-2026-18558

Exploitation requires an authenticated account with contributor-level privileges or above (consistent with CVSS PR:L), and the injected payload is delivered specifically through the 'embeddoc' shortcode, which the plugin fails to adequately sanitize on input and escape on output. The script does not fire until a user - ideally a higher-privileged editor or administrator - accesses the page containing the injected shortcode, so a victim page view is the triggering event. Key limiting factors: the attacker must first obtain a contributor (or higher) account, the Embed Any Document plugin must be installed and active at version ≤2.7.13, and the site must permit the 'embeddoc' shortcode in author-controllable content. Single-author or admin-only sites, or sites that do not provision contributor accounts to untrusted parties, have substantially reduced real-world exposure.

This is a moderate-severity Stored XSS (CWE-79) with CVSS 6.4. The provided vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) shows a network-exploitable, low-complexity flaw but with a meaningful barrier: PR:L means an attacker must already hold at least contributor-level authenticated access, which matches the description ('authenticated attackers, with contributor-level access and above'). No EPSS score, KEV listing, or POC was provided in the input. Exploitation status is therefore 'no public exploit identified at time of analysis' - this is NOT in CISA KEV and no public exploit code is referenced. The scope change (S:C) and limited confidentiality/integrity impact (C:L/I:L) reflect typical stored-XSS behavior where injected script executes in another user's browser session, potentially an administrator. Net assessment: a real but second-tier priority. It requires a pre-existing low-privilege account, so it is most relevant to multi-author WordPress sites that grant contributor accounts to semi-trusted users; single-admin sites face negligible exposure. Absent EPSS/KEV/POC data, there is no signal of active or widespread exploitation, so this should be patched on a normal cadence rather than as an emergency.

An attacker who holds a contributor-level account on a multi-author WordPress site inserts a malicious payload into the 'embeddoc' shortcode within a draft or page. When an editor, administrator, or site visitor later opens that page, the unsanitized script executes in their browser, enabling session hijacking or actions performed as the higher-privileged victim. No public exploit code was provided in the input, and exploitation requires the victim to view the injected page.