Pdf Embedder Vulnerabilities

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key exposure occurs when the...

CVSS:

4.3

Affected:

up to 4.9.3

Fixed in:

5.0.0

Disclosed:

May 27, 2026

CVE-2026-7526 on NVD →

PDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can successfully trick a user into opening...

CVSS:

6.4

Affected:

up to 4.7.1

Fixed in:

4.8.0

Disclosed:

May 20, 2024

CVE-2024-4367 on NVD →

The PDF Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 4.6.4

Fixed in:

4.7.1

Disclosed:

Mar 18, 2024

CVE-2024-29141 on NVD →