Embed Any Document Embed Pdf Word Powerpoint And Excel Files
Monthly
Stored cross-site scripting in the Embed Any Document WordPress plugin (all versions through 2.7.13) lets authenticated users with contributor-level access or above plant arbitrary JavaScript in post content through the plugin's 'embeddoc' shortcode; the script lies dormant until any visitor - commonly a higher-privileged editor or administrator reviewing the page - loads the affected content. The issue carries a CVSS 3.1 score of 6.4 (medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N that confirms remote reachability but an authenticated (PR:L) prerequisite and a scope change indicating execution in the context of the site. No public exploit code identified at time of analysis, and real-world exposure is limited to sites that run the vulnerable plugin, permit the 'embeddoc' shortcode in author-controllable content, and grant contributor accounts to untrusted parties.
Stored cross-site scripting in the Embed Any Document WordPress plugin (all versions through 2.7.13) lets authenticated users with contributor-level access or above plant arbitrary JavaScript in post content through the plugin's 'embeddoc' shortcode; the script lies dormant until any visitor - commonly a higher-privileged editor or administrator reviewing the page - loads the affected content. The issue carries a CVSS 3.1 score of 6.4 (medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N that confirms remote reachability but an authenticated (PR:L) prerequisite and a scope change indicating execution in the context of the site. No public exploit code identified at time of analysis, and real-world exposure is limited to sites that run the vulnerable plugin, permit the 'embeddoc' shortcode in author-controllable content, and grant contributor accounts to untrusted parties.