93 matches found
CVE-2014-9173
CVE-2014-9173: Google Document Embedder - Time-Based Blind SQL Injection Exploitation Author: ratiros01 Original PoC: https://www.exploit-db.com/exploits/35371...
CVE-2026-62037
Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...
EUVD-2026-96471
Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...
CVE-2026-62037
The WordPress Document Embedder plugin, versions
CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...
PT-2026-109803
Name of the Vulnerable Software and Affected Versions Document Embedder versions prior to 2.4.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update to a version newer than 2.4....
CVE-2026-62037: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...
WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Document Embedder versions = 2.4.0...
WordPress Document Embedder plugin < 2.3.1 - Unauthenticated Private Document Download vulnerability
Unauthenticated Private Document Download vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Document Embedder versions 2.3.1...
CVE-2026-16567
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567
The Document Embedder WordPress plugin, in versions before 2.3.1 , is vulnerable to an unauthenticated private document download. The flaw occurs because the plugin fails to verify a document's status before issuing a download token and streaming the file. This allows an unauthenticated attacker ...
CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
EUVD-2026-66870
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
PT-2026-82386
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567: Authorization Bypass Through User-Controlled Key
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-1389
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...
CVE-2026-1389 Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...
CVE-2026-1389
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...