Wonderplugin Pdf Embed Vulnerabilities

PDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can successfully trick a user into opening...

CVSS:

6.4

Affected:

up to 2.7

Fixed in:

2.8

Disclosed:

May 20, 2024

CVE-2024-4367 on NVD →

[en] A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Affected:

up to 2.8

Fixed in:

2.8

Disclosed:

May 14, 2024

CVE-2024-4367 on NVD →

[en] The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.

Affected:

up to 1.7

Fixed in:

1.7

Disclosed:

Aug 16, 2021

CVE-2021-24541 on NVD →

The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.

CVSS:

6.4

Affected:

up to 1.6

Fixed in:

1.7

Disclosed:

Jul 19, 2021

CVE-2021-24541 on NVD →