Vulnerabilities / Document Embedder – let visitors read files without downloading
Document Embedder – let visitors read files without downloading vulnerabilities
Advisories WPSec published for Document Embedder – let visitors read files without downloading. Other sources may list more. Its attack surface: Document Embedder – let visitors read files without downloading on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-18 | WPSEC-2026-1211 | Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Library File URLs | Medium 6.4 | 2.4.1 |
| 2026-10-18 | WPSEC-2026-1210 | Document Embedder – let visitors read files without downloading <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Document Embed Block 'doc' Attribute | Medium 6.4 | 2.4.1 |
License: CC BY 4.0