Document Embedder Let Visitors Read Files Without Downloading
Monthly
Stored DOM-based cross-site scripting in the Document Embedder WordPress plugin, affecting all versions up to and including 2.4.0, allows authenticated users with contributor-level access or higher to place attacker-controlled script in a post's Document Embedder block JSON. The payload executes when a victim clicks the embedded document's Download button, which routes through the de_track_download AJAX fallback after docId=0 makes can_read_document() return false, so real-world exploitation depends on that victim interaction. No public exploit was identified at time of analysis, and upgrading to 2.4.1 is the remediation.
Stored DOM-based cross-site scripting in the Document Embedder WordPress plugin, affecting all versions up to and including 2.4.0, allows authenticated users with contributor-level access or higher to place attacker-controlled script in a post's Document Embedder block JSON. The payload executes when a victim clicks the embedded document's Download button, which routes through the de_track_download AJAX fallback after docId=0 makes can_read_document() return false, so real-world exploitation depends on that victim interaction. No public exploit was identified at time of analysis, and upgrading to 2.4.1 is the remediation.