EUVD-2026-96471
GHSA-2wp9-wcq4-wrjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload/link
-
DeliveryDeliver to target user via link or page
-
ExploitVictim browser renders unsanitized input
-
ExecutionAttacker JavaScript executes in site context
-
ImpactHijack session or forge admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim (e.g., a site administrator or visitor) interact with attacker-supplied content - opening a crafted link or page - so that the Document Embedder plugin (<= 2.4.0) renders unsanitized input and executes JavaScript in the browser; this UI:R requirement is the primary limiting factor. No authentication is needed to deliver the payload (PR:N). The site must be running the vulnerable Document Embedder plugin version 2.4.0 or earlier; the specific injectable parameter or embed field is not detailed in the available data and should be confirmed against the Patchstack advisory. |
| Impact | This is a reflected/stored unauthenticated Cross-Site Scripting flaw (CWE-79) in the Document Embedder WordPress plugin at or below version 2.4.0, reported by Patchstack and scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS signals point to network-reachable, low-complexity, unauthenticated exploitation, but the UI:R (user interaction required) metric meaningfully caps real-world risk: an attacker cannot exploit this autonomously and must lure a victim into triggering the payload. The scope-change (S:C) metric is why the limited C/I/A impacts still aggregate to 7.1 - typical for XSS where script executes in a different security context (the browser/session). No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so there is no public exploit identified at time of analysis. This is a legitimate but moderate-priority issue rather than an emergency: it is an XSS in a niche plugin requiring victim interaction, not a wormable unauthenticated RCE. Note the A:L (availability impact) in the supplied vector is atypical for classic XSS and may be a conservative Patchstack/vendor scoring artifact - verify, as pure XSS usually carries A:N. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL or embeds a payload that reaches a vulnerable Document Embedder output path on a WordPress site running version 2.4.0 or earlier, then entices a logged-in administrator or visitor to open it. When the victim's browser renders the unsanitized input, attacker-controlled JavaScript executes in the site's context, enabling session/cookie theft, admin-action forgery, or content manipulation. No authentication is needed to deliver the payload, but victim interaction (UI:R) is required to trigger it; no public proof-of-concept is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
RemediationAI
Vendor-released patch: none identified in the available data - the provided intelligence contains no fixed version, so no specific patched release number should be assumed and the Patchstack record (https://patchstack.com/database/wordpress/plugin/document-emberdder/vulnerability/wordpress-document-embedder-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve) plus the plugin's WordPress.org changelog should be checked for an update beyond 2.4.0 and applied as soon as one appears via the normal WordPress plugin update flow. Until a fix is confirmed, the most effective compensating control is to deactivate and remove Document Embedder from any site that does not strictly need it, accepting the loss of embedded document rendering on affected pages; where the functionality is required, restrict the ability to insert embeds to a small set of trusted, high-privilege editors (Administrator/Editor roles only, removing Author/Contributor posting capability) so untrusted users cannot place payloads, and remove or rewrite any existing embeds that contain unexpected script or HTML markup. Because exploitation depends on a victim clicking a crafted link or visiting a crafted page, deploy a WordPress-aware WAF or virtual patching rule from a provider such as Patchstack to block XSS payloads targeting the plugin's embed parameters, understanding that WAF signatures can be bypassed with encoding tricks and that virtual patching does not remediate the underlying code. Enforce HttpOnly and Secure attributes on WordPress authentication cookies and enable Content Security Policy headers that disallow inline script, which reduces session-token theft and script execution respectively but may break legitimate plugin or theme functionality and requires testing. Finally, treat administrator sessions on affected sites as potentially compromised: rotate administrator passwords and salts, invalidate active sessions, and audit posts, widgets, and plugin settings for injected content if any administrator visited untrusted links while the vulnerable plugin was active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Document Embedder is a WordPress plugin that renders embedded documents (PDFs, Office files, and similar content) inside posts and pages, typically through shortcodes or embed blocks. The vulnerability class is CWE-79, improper neutralization of input during web page generation, meaning user-controllable data reaches the generated HTML output without adequate escaping or sanitization, so injected markup and script tags are interpreted by the browser rather than displayed as text. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable flaw with low attack complexity that needs no credentials to deliver, but does require a victim to open a crafted link or page; the S:C scope change is significant because the injected script executes in the security context of the affected WordPress site's origin rather than in a sandboxed context, enabling cookie/session theft, request forgery against the site, content injection, or redirection - the classic privilege-escalation path from an unauthenticated visitor into an administrator session. The affected CPE is cpe:2.3:a:bplugins:document_embedder:*:*:*:*:*:*:*:*, which enumerates the product family with all versions flagged in that CPE entry; the advisory narrows the practical affected range to 2.4.0 and earlier. The specific injectable parameter or embed field is not detailed in the available intelligence and should be confirmed against the Patchstack advisory. Note that the authoritative independent assessment scores the availability impact as none (A:N) rather than low, so the practical impact should be treated as confidentiality and integrity compromise via script execution rather than denial of service.
Know when Document Embedder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-delivered XSS (AV:N/PR:N) needs victim interaction (UI:R); script runs cross-context (S:C) with limited confidentiality/integrity impact and no genuine availability impact (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
Executive ViewAI
Document Embedder (bplugins), a WordPress plugin used to display embedded documents, is affected through version 2.4.0 by an unauthenticated cross-site scripting flaw that runs attacker-supplied JavaScript in the browser of anyone who opens a crafted link or page - including logged-in administrators, whose sessions operate with full site privileges. Because the script executes in the affected site's own origin, a successful attack could enable content tampering, session or credential theft, or broader compromise of the WordPress installation, affecting site owners, their staff, and any visitors or customers who interact with the malicious content. No vendor patch is currently available, so this remains an open, unmitigated exposure wherever the plugin is deployed and should be treated as a priority remediation item despite the requirement that a victim interact with the crafted content.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall Document Embedder (bplugins) on all instances at version 2.4.0 or earlier; if it must remain active, restrict embed/document publishing to trusted roles, enforce a Content-Security-Policy disallowing inline and untrusted third-party script, and apply virtual patching or WAF rules blocking script injection through the plugin's embed rendering; monitor WordPress logs and administrator sessions for suspicious activity; re-check the vendor advisory and the WordPress plugin repository for a fixed release and upgrade immediately when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB