CVE-2014-9173

CVE-2014-9173: Google Document Embedder - Time-Based Blind SQL Injection Exploitation Author: ratiros01 Original PoC: https://www.exploit-db.com/exploits/35371...

CVE-2026-62037

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

EUVD-2026-96471

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-62037

The WordPress Document Embedder plugin, versions

CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

PT-2026-109803

Name of the Vulnerable Software and Affected Versions Document Embedder versions prior to 2.4.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update to a version newer than 2.4....

CVE-2026-62037: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Document Embedder versions = 2.4.0...

WordPress Document Embedder plugin < 2.3.1 - Unauthenticated Private Document Download vulnerability

Unauthenticated Private Document Download vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Document Embedder versions 2.3.1...

CVE-2026-16567

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567

The Document Embedder WordPress plugin, in versions before 2.3.1 , is vulnerable to an unauthenticated private document download. The flaw occurs because the plugin fails to verify a document's status before issuing a download token and streaming the file. This allows an unauthenticated attacker ...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

EUVD-2026-66870

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

PT-2026-82386

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567: Authorization Bypass Through User-Controlled Key

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-1389

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...

CVE-2026-1389 Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...

CVE-2026-1389

CVE-2026-1389 affects the WordPress plugin Document Embedder (

CVE-2026-1389

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the...