CVE-2025-23922

CVE-2025-23922 - WordPress iSpring Embedder CSRF to Arbitrary File Upload 📌 CVE Details CVE ID: CVE-2025-23922 Published: 2025-01-16 Plugin Affected: WordPress iSpring Embedder plugin Versions Affected: CSRF File Upload Exploit body font-f...

Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass

The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the wplogin parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This...

CVE-2014-9173

CVE-2014-9173: Google Document Embedder - Time-Based Blind SQL Injection Exploitation Author: ratiros01 Original PoC: https://www.exploit-db.com/exploits/35371...

CVE-2026-109370

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

CVE-2026-109370

The Document Embedder WordPress plugin (versions up to and including 2.4.0 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The issue stems from insufficient input sanitization and output escaping within the content parameter (specifically post_content containing block JSON docume...

CVE-2026-109370 Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

EUVD-2026-111607

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content postcontent containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

PT-2026-127860

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content post content containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

WordPress Document Embedder – let visitors read files without downloading plugin <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Document Embedder versions = 2.4.0...

CVE-2026-62037

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-62037

The WordPress Document Embedder plugin, versions

EUVD-2026-96471

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

PT-2026-109803

Name of the Vulnerable Software and Affected Versions Document Embedder versions prior to 2.4.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user. Recommendations Update to a version newer than 2.4....

CVE-2026-62037: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Document Embedder versions = 2.4.0...

CVE-2026-92727

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92727

The EmbedPress plugin for WordPress (versions up to and including 4.6.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'slidesShow' Block Attribute . Specifically, the attribute is interpolated into an unquot...

EUVD-2026-91896

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...