CVE-2026-109370

MediumCVSS 6.4

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The Document Embedder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in versions up to and including 2.4.0 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary web scripts that execute when a user visits the injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.

Risk Assessment

An attacker with Contributor privileges can execute arbitrary JavaScript in a user's browser after the download button is clicked, potentially leading to session theft or other actions.

Recommendation

Update the Document Embedder plugin to a version later than 2.4.0 and restrict Contributor privileges until the fix is applied.

Other vulnerabilities in Document Embedder WordPress plugin

CVE-2026-16567Medium
The Document Embedder WordPress plugin before version 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary documents, including private and draft ones, by enumerating IDs.

Original NVD description (English source)

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS