WordPress plugin
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 5 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium5
- Low0
All Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode ≤2.7.13Update to 2.7.14 | CVE-2026-18558 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.7.10Update to 2.7.11 | CVE-2025-12885 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.7.7Update to 2.7.8 | CVE-2025-60099 | |
| Medium6.4 | Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode ≤2.7.5Update to 2.7.6 | CVE-2025-1043 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting via SVG files ≤2.7.1Update to 2.7.2 | CVE-2023-23707 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
≤2.7.13Update to 2.7.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.10Update to 2.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.7.7Update to 2.7.8
- Medium6.4Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode
≤2.7.5Update to 2.7.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG files
≤2.7.1Update to 2.7.2
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: common questions
Does Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: 5 medium. None are known to affect version null.
How do I check which version of Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files vulnerability?
CVE-2026-18558, published Oct 9, 2026: Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode. Severity: Medium (CVSS 6.4).
Is any Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files vulnerability listed in CISA KEV?
No. None of the known Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files vulnerabilities is currently listed in the CISA KEV catalog.