Embed Pdf Viewer Vulnerabilities

[en] Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Request Forgery.This issue affects Embed PDF Viewer: from n/a through <= 2.4.7.

Affected:

up to 2.4.7

Fix:

No patched version reported

Disclosed:

Mar 13, 2026

CVE-2026-32349 on NVD →

The Embed PDF Viewer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be u...

CVSS:

6.4

Affected:

up to 2.4.7

Fixed in:

2.4.8

Disclosed:

Feb 11, 2026

CVE-2026-32349 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer allows Stored XSS.This issue affects Embed PDF Viewer: from n/a through 2.3.1.

Affected:

up to 2.4.0

Fixed in:

2.4.0

Disclosed:

Dec 31, 2024

CVE-2024-56256 on NVD →

The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will...

CVSS:

4.4

Affected:

up to 2.3.1

Fixed in:

2.4.0

Disclosed:

Dec 19, 2024

CVE-2024-56256 on NVD →

Affected:

up to 2.4.0

Fixed in:

2.4.0

Disclosed:

Dec 19, 2024

CVE-2024-56256 on NVD →

[en] The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

Affected:

up to 2.4.5

Fixed in:

2.4.5

Disclosed:

Oct 9, 2024

CVE-2024-9451 on NVD →

The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abo...

CVSS:

6.4

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Oct 8, 2024

CVE-2024-9451 on NVD →

Affected:

up to 2.4.5

Fixed in:

2.4.5

Disclosed:

Oct 8, 2024

CVE-2024-9451 on NVD →