CVE-2026-109370Medium· 6.4▾ SunlitThe Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all ve…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is triggered specifically when the victim clicks the embedded document's Download button, which causes the de_track_download AJAX fallback path to programmatically create an anchor with the attacker-controlled href and call .click() — a condition reached because supplying docId=0 causes can_read_document() to return false, bypassing the normal download flow.
document_embedder_let_visitors_read_files_without_downloading <= 2.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116849Medium· 6.5WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
CVE-2026-52709Medium· 6.5WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-48195Medium· 6.5WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-116395Medium· 6.5WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-116400Medium· 6.5WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-116398Medium· 6.5WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability