CVE-2026-109370 Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

CVE-2026-109370

The Document Embedder WordPress plugin (versions up to and including 2.4.0 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The issue stems from insufficient input sanitization and output escaping within the content parameter (specifically post_content containing block JSON docume...