document_embedder_let_visitors_read_files_without_downloading vulnerabilities

CVEs whose affected-version data names the document_embedder_let_visitors_read_files_without_downloading package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-109370Medium· 6.4

6d ago

Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all ve…

▾ Sunlitbplugins · Document Embedder – let visitors read files without downloadingEPSS 0.22%via CVEORG