Document Embedder
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.