Stored DOM-Based Cross-Site Scripting in Document Embedder Plugin for WordPress

CVE-2026-109370

What is CVE-2026-109370?

The Document Embedder plugin for WordPress has a vulnerability due to inadequate input sanitization and output escaping, allowing authenticated users, specifically those with contributor access or higher, to exploit the 'content' parameter. This vulnerability enables attackers to inject malicious web scripts into pages accessed by unsuspecting users. The exploit is activated when users click the embedded document's Download button. At this point, the payload is triggered via an AJAX call that circumvents the intended download process, creating an anchor link with a harmful URL that can lead to unauthorized actions when interacted with.

References