Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · document-emberdder
Document Embedder
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026Document Embedder – let visitors read files without downloading: Stored DOM-Based Cross-Site ScriptingCVE-2026-109370 · affects up to 2.4.0 · reported by WordfenceMedium 6.4
The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.CVE-2026-62037 · affects up to 2.4.0 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
Aug 27, 2026Document Embedder: Does not check a document's status before issuing a download token and streaming the fileCVE-2026-16567 · fixed in 2.3.1 · reported by WPScanMedium 5.3
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
Jan 28, 2026Document Embedder – Embed PDFs, Word, Excel, and Other Files: Insecure Direct Object ReferenceCVE-2026-1389 · affects up to 2.0.4 · reported by WordfenceMedium 4.3
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the 'bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library' AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the 'id' parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2025Document Embedder – Embed PDFs, Word, Excel, and Other Files: Unauthorized access/modification/loss of dataCVE-2025-12384 · affects up to 2.0.0 · reported by WordfenceHigh 8.6
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_library" functions. This makes it possible for unauthenticated attackers to create, read, update, and delete arbitrary document_library posts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 1, 2022Document Embedder: Contains a AJAX action endpointCVE-2021-24868 · fixed in 1.7.9 · reported by WPScanMedium 4.3
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
Feb 1, 2022Document Embedder: Contains a REST endpointCVE-2021-24775 · fixed in 1.7.5 · reported by WPScanMedium 5.3
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.